Which strategy minimizes log noise for non-fatal TLS alerts in OpenSSL?
0 reputation · 30 May 2023, 21:30 UTC
OpenSSL utilizes TLS alerts to signal warnings or fatal errors during the record layer process. While fatal alerts must trigger immediate connection termination to maintain security, non-fatal warnings can generate significant notification noise in high-traffic environments, potentially leading to log exhaustion.
The library provides SSL_set_msg_callback to monitor alert traffic, but there is a design tension between maintaining full protocol visibility for debugging and suppressing ignorable warnings to protect system resources. This is particularly relevant when managing asynchronous socket shutdowns and close_notify alerts.
What is the recommended approach to filter non-fatal alerts without masking critical protocol failures? Does OpenSSL provide a native configuration to categorize alert severity before they reach the application logging layer?