TLS 1.3 requires a call to SSL_CTX_set_ciphersuites

[gastush]

To configure TLS 1.3 permitted ciphers, OpenSSL requires to call SSL_CTX_set_ciphersuites instead of SSL_CTX_set_ciphers like for TLS 1.2 and below.
Both APIs will ignore unknown ciphers, so giving the same list to both is correct. Still to avoid any side effects, each API is only called of the respective TLS protocol version is allowed on the SSL context.

[rmaucher]

That looks good, I added this strategy (mostly for testing) in the FFM code and there does not seem to be any issues.
Note: Although it seems logical to add this, the actual usefulness seems very limited.

[michael-o]

That looks good, I added this strategy (mostly for testing) in the FFM code and there does not seem to be any issues. Note: Although it seems logical to add this, the actual usefulness seems very limited.

Why do you consider it as limited?

[rmaucher]

That looks good, I added this strategy (mostly for testing) in the FFM code and there does not seem to be any issues. Note: Although it seems logical to add this, the actual usefulness seems very limited.

Why do you consider it as limited?

There are very few ciphers for TLS 1.3 and they are not broken, so there's not much to configure.