search

libressl / portable

LibreSSL Portable itself. This includes the build scaffold and compatibility layer that builds portable LibreSSL from the OpenBSD source code. Pull requests or patches sent to tech@openbsd.org are welcome.
https://www.libressl.org
1.34k stars 269 forks source link

DANE-TA #502

Open hdatma opened 5 years ago

hdatma commented 5 years ago

I get the following when compiling ldns without "--disable-dane-ta-usage".

Configure: error: OpenSSL [LibreSSL] does not support offline DANE verification (Needed for the DANE-TA usage type). Please upgrade OpenSSL to version >= 1.1.0 or rerun with --disable-dane-verify or --disable-dane-ta-usage

Are there any plans to support offline DANE verification?

yonas commented 3 years ago

Support for DANE-TA would be great.

hdatma commented 3 years ago

Support for DANE-TA would be great.

Although libressl is the default in openbsd, and openbsd claims to be the best in security, the lack of DANE support is undermining the claim. The openbsd project does not use DANE, so they have no experience with it. We rely on DANE, and therefore we deprecated libressl in our projects. Three years are a long time to hold breath.