From 4577a0dc21ddae9c7eaf269e91194ffdf2ab31b3 Mon Sep 17 00:00:00 2001 From: Arne Schwabe Date: Sun, 22 Mar 2026 12:12:01 +0100 Subject: [PATCH] Do not support tls_ctx_set_cert_profile on AWS-LC SSL_CTX_set_security_level does nothing on AWS-LC and gives a deprecated warning on compile. It is better to give the user a warning than to effectively silently ignore it as well. Change-Id: I74841d3611c62d3c59fc839bc73a0c83ce025262 Signed-off-by: Arne Schwabe Acked-by: Frank Lichtenheld Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1579 Message-Id: <20260322111207.8346-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg36243.html Signed-off-by: Gert Doering (cherry picked from commit 07954eea058996d753f7196859c25a0e076ef896) --- src/openvpn/ssl_openssl.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c index 80aef697..0cf9bf72 100644 --- a/src/openvpn/ssl_openssl.c +++ b/src/openvpn/ssl_openssl.c @@ -518,8 +518,9 @@ tls_ctx_restrict_ciphers_tls13(struct tls_root_ctx *ctx, const char *ciphers) void tls_ctx_set_cert_profile(struct tls_root_ctx *ctx, const char *profile) { -#if OPENSSL_VERSION_NUMBER > 0x10100000L \ - && (!defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER > 0x3060000fL) +#if OPENSSL_VERSION_NUMBER > 0x10100000L \ + && (!defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER > 0x3060000fL) \ + && !defined(OPENSSL_IS_AWSLC) /* OpenSSL does not have certificate profiles, but a complex set of * callbacks that we could try to implement to achieve something similar. * For now, use OpenSSL's security levels to achieve similar (but not equal) @@ -549,8 +550,8 @@ tls_ctx_set_cert_profile(struct tls_root_ctx *ctx, const char *profile) if (profile) { msg(M_WARN, - "WARNING: OpenSSL 1.1.0 and LibreSSL do not support " - "--tls-cert-profile, ignoring user-set profile: '%s'", + "WARNING: OpenSSL 1.1.0, AWS-LC and LibreSSL < 3.6.0 do not " + "support --tls-cert-profile, ignoring user-set profile: '%s'", profile); } #endif /* if OPENSSL_VERSION_NUMBER > 0x10100000L */