Skip to content

chore(deps): Remove OpenSSL 1.1.1 fallback, require OpenSSL 3.0+ #386

@kcenon

Description

@kcenon

What

Remove OpenSSL 1.1.1 fallback support and enforce OpenSSL 3.0+ as the minimum required version for PostgreSQL SSL connections and other encrypted database transports.

Why

  • Security risk: OpenSSL 1.1.1 reached End of Life (EOL) on September 11, 2023. Database connection encryption with an EOL library is a critical vulnerability.
  • SOUP compliance: For safety-critical systems (IEC 62304), using EOL cryptographic libraries in data transport is a high-risk finding requiring immediate mitigation.
  • Consistency: logger_system and network_system are also migrating to OpenSSL 3.0+ only. Ecosystem-wide alignment reduces testing complexity.
  • PostgreSQL compatibility: PostgreSQL 16+ recommends OpenSSL 3.x for SSL connections.

Where

  • CMakeLists.txt or cmake/FindSystemDependency.cmake: OpenSSL detection
  • database/CMakeLists.txt: PostgreSQL backend SSL linkage
  • scripts/dependency.sh: Platform dependency installation
  • CI/CD workflows

How

  1. Update OpenSSL version requirement to 3.0.0 minimum
  2. Remove any OpenSSL 1.1.x conditional code paths
  3. Update scripts/dependency.sh to install OpenSSL 3.x packages
  4. Verify PostgreSQL SSL connections work with OpenSSL 3.x
  5. Update README prerequisites

Acceptance Criteria

  • OpenSSL 3.0.0+ enforced at configure time
  • All OpenSSL 1.1.x fallback code removed
  • PostgreSQL SSL connection tests pass
  • scripts/dependency.sh installs OpenSSL 3.x
  • CI passes on all platforms

Metadata

Metadata

Assignees

Labels

dependenciesExternal dependencies managementpriority:highHigh priority issuesecuritySecurity related features

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions