]> git.ipfire.org Git - thirdparty/haproxy.git/commit
BUG/MINOR: acme: P-256 doesn't work with openssl >= 3.0
authorWilliam Lallemand <wlallemand@haproxy.com>
Tue, 18 Nov 2025 10:34:28 +0000 (11:34 +0100)
committerWilliam Lallemand <wlallemand@haproxy.com>
Tue, 18 Nov 2025 10:34:28 +0000 (11:34 +0100)
commit177816d2b80ba9bdedc075ec3d4dc1fb9fd823ab
tree3685eb8e42781bd8f008e28b4d621821c9bcdc07
parent9bf01a0d296b6f1a4de4f932ae8e7f250a58fa25
BUG/MINOR: acme: P-256 doesn't work with openssl >= 3.0

When trying to use the P-256 curve in the acme configuration with
OpenSSL 3.x, the generation of the account was failing because OpenSSL
doesn't return a NIST or SECG curve name, but a ANSI X9.62 one.

Since the ANSI X9.62 curve names were not in the list, it couldn't match
anything supported.

This patch fixes the issue by adding both prime192v1 and prime256v1 name
in the struct curve array which is used during curve parsing.

Must be backported to 3.2.
src/ssl_utils.c