tree 42684f8bd8b3f555d8273a4db3b8d3ce5719d789
parent eb561cefd46e735563d33ace691f62a0c39e6ac8
author Remi Tricot-Le Breton <rlebreton@haproxy.com> 1644338756 +0100
committer William Lallemand <wlallemand@haproxy.org> 1644401744 +0100

MINOR: ssl: Remove EC_KEY related calls when creating a certificate

In the context of the 'generate-certificates' bind line option, if an
'ecdhe' option is present on the bind line as well, we use the
SSL_CTX_set_tmp_ecdh function which was marked as deprecated in
OpenSSLv3. As advised in the SSL_CTX_set_tmp_ecdh manpage, this function
should be replaced by the SSL_CTX_set1_groups one (or the
SSL_CTX_set1_curves one in our case which does the same but existed on
older OpenSSL versions as well).

The ECDHE behaviour with OpenSSL 1.0.2 is not the same when using the
SSL_CTX_set1_curves function as the one we have on newer versions.
Instead of looking for a code that would work exactly the same
regardless of the OpenSSL version, we will keep the original code on
1.0.2 and use newer APIs for other versions.

This patch should be strictly isofunctional.