GnuTLS support for the mod_ssl
any objections against adding gnutls support?
Updated by ckujau about 8 years ago
+1 from me, especially since the new TLSv1.0 vuln has been disclosed: https://www.net-security.org/secworld.php?id=11664
GnuTLS has TLSv1.2 support since 2.9.8 (released 2009-11-05)
Updated by gstrauss over 3 years ago
- Status changed from New to Need Feedback
I build gnutls with:
[gnutls-3.4.2]$ ./configure -C --enable-openssl-compatibility --disable-non-suiteb-curves
suggested --disable-non-suiteb-curves on systems with nettle without
secp192 and secp224 curves
However, concerns have been raised about using gnutls, which (BTW) is no longer associated with the GNU Foundation.
(published in 2014) suggests that GnuTLS might not be the best choice in
TLS libraries, questioning some of its design limitations. Caveat emptor.
(Alternatives include OpenSSL, LibreSSL, BoringSSL, wolfSSL, mbed TLS, ...)
gnutls does not provide compatible headers to openssl, even when gnutls is configured --enable-openssl-compatibility. Combined with the above design criticisms (link), is adding support for GnuTLS still worth the effort?
I have tested lighttpd with openssl and libressl. Other implementations which supply openssl-compatible headers and interfaces are also likely to work with lighttpd with little to no extra effort.
Also available in: Atom