ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
Security & identity · #openssl
Goal Compute one message digest over a large dataset read in bounded pages, keeping memory usage constant instead of loading the full input into memory. Constraint OpenSSL provides EVP_DigestUpdate for incremental hashing and EVP_DigestEx for a single-call digest. The incremental API avoids loading the entire dataset but requires per-chunk context handling.
The same project needs to behave consistently on developer machines, in CI and after deployment. Which versions, dependencies and configuration should be recorded?
When implementing non-blocking I/O with OpenSSL, SSL_write may return a value indicating that only a portion of the provided buffer was processed. This typically occurs when the underlying transport layer is saturated, triggering an SSL_ERROR_WANT_WRITE return code. The primary design constraint is ensuring data integrity by avoiding duplicate writes. Becaus
An upgrade needs a compatibility check, a tested release and a recovery path. Which changes deserve particular attention before the new version reaches production?
PHP utilizes the OpenSSL extension to validate certificates during TLS handshakes for HTTPS requests. When the underlying library cannot locate a trusted root CA bundle, the system triggers a validation failure. The php.ini configuration provides openssl.cafile and openssl.capath to define these trust stores. However, there is often a discrepancy between the
Determine whether OpenSSL’s SSL_CTX_free function should automatically flush the internal session cache when the SSL_CTX object's reference count drops to zero, thereby eliminating ambiguous memory usage patterns. The reference‑counting mechanism added in OpenSSL 1.1.1 prevents leaks caused by freeing an SSL_CTX while active SSL objects still reference it, b
DANE Validation and DNSSEC Dependency OpenSSL provides experimental support for DNS-based Authentication of Named Entities (DANE) via the -dane flag in s_client . This feature allows the client to retrieve TLSA records to verify TLS certificates, reducing reliance on traditional Certificate Authorities. A critical requirement for DANE security is the authent
Compare suitability, operational responsibilities and limits before choosing this technology for a project. Which trade-offs should guide the decision?
Symptom A Boost.Asio SSL client configured with ssl::verify_peer successfully validates a server certificate chain — trust anchor, expiration, and signature — yet connects to a host whose certificate contains a different Subject Alternative Name or Common Name than the target hostname. No verification failure occurs unless the application installs a custom c