librdkafka icon indicating copy to clipboard operation
librdkafka copied to clipboard

Add support for setting TLSv1.3 ciphers

Open morzelx opened this issue 1 year ago • 3 comments

Currently library supports setting ciphers only for TLSv1.2 and below. Due to major differences between the way that ciphersuites for TLSv1.2 and below and ciphersuites for TLSv1.3 work, they are configured by a different OpenSSL function: SSL_CTX_set_ciphersuites. Because of that it is not possible to configure TLSv1.3 ciphers in option "ssl.cipher.suites", as it calls old OpenSSL function (SSL_CTX_set_cipher_list) under the hood.

This patch adds possibility to set ciphersuites for TLSv1.3 via new configuration option: "ssl.tls13.ciphersuites". I suspect it is the most convenient way to resolve this for now, as older TLS ciphers still expect to be configured using older OpenSSL function.

This also should resolve question raised in discussion thread #4286.

morzelx avatar Jun 28 '23 11:06 morzelx

@milindl @edenhill - I'm also interested in the changes. Is there something which can be done to bring this PR to your attention?

aambroze avatar Jul 28 '23 10:07 aambroze

CLA assistant check
All committers have signed the CLA.

cla-assistant[bot] avatar Aug 21 '23 14:08 cla-assistant[bot]

I am also in need for this support.

hubertmowinski avatar Nov 17 '23 12:11 hubertmowinski