OpenSSL Unified Cipher Policy Across TLS Versions

Operators often want a single cipher policy string that governs both TLS 1.2 and TLS 1.3 connections to simplify configuration and avoid version‑specific drift. In OpenSSL, TLS 1.3 cipher suites are set only with SSL_CTX_set_ciphersuites, while SSL_CTX_set_cipher_list applies to TLS 1.2 and earlier, so a single string cannot cover both protocol versions.

This separation leaves an unresolved decision: whether to disable TLS 1.3 entirely to enforce one policy, or to maintain two parallel policies and manage their consistency. Each approach carries trade‑offs in client compatibility, operational complexity, and potential impact on handshake performance. The question is how to achieve the desired uniform policy without sacrificing support for modern clients or introducing unnecessary overhead. Is disabling TLS 1.3 an acceptable trade‑off for a unified cipher policy? Does maintaining separate SSL_CTX_set_cipher_list and SSL_CTX_set_ciphersuites configurations create unacceptable operational overhead? Can security‑level settings be used to effectively constrain both TLS 1.2 and TLS 1.3 suites without disabling any version?