openssl: drop support for old OpenSSL/LibreSSL versions

[vszakats]

Require OpenSSL 1.0.2a (2015-03-19) or LibreSSL 2.9.1 (2019-04-13).

---

w/o whitespace: https://github.com/curl/curl/pull/16104/files?w=1

[MarcelRaad]

Looks good to me in general, but maybe we should announce that first? Going from 0.9.7 to 1.0.2a is quite a huge jump.

Or maybe go with a safer minimum first? From a usability perspective, 1.0.1 might make sense, which was the first version to support TLS 1.2 and 1.1. It was supported until January 1, 2017.
From a workaround perspective, even 0.9.8h would be great. It was supported until January 1, 2016.

[vszakats]

Looks good to me in general, but maybe we should announce that first? Going from 0.9.7 to 1.0.2a is quite a huge jump.

Or maybe go with a safer minimum first? From a usability perspective, 1.0.1 might make sense, which was the first version to support TLS 1.2 and 1.1. It was supported until January 1, 2017. From a workaround perspective, even 0.9.8h would be great. It was supported until January 1, 2016.

It terms of cryptography and bugs, I think OpenSSL 1.0.1 and 0.9.8 did not age
well. Things happened much faster there in the last decade, than with other
components. They have many issues.

Is there any major platform using 1.0.1 or 0.9.8?

curl is also deprecating TLS backends without TLS 1.3 support, in May. This
doesn't specifically include OpenSSL, but OpenSSL 1.1.0 and older also don't
support it.

The oldest version we CI test is 1.0.2 (in Old Linux). Hard to say if earlier
versions still build and work as expected.

Upgrading from those to 1.0.2 used to be easy (IIRC). Certainly not like the 1.1.0
upgrade that required complicated code changes.

For these reasons IMO abandoning 1.0.1 and older seems fine. Announcing it
would be nice, probably, but I don't know much about that. /cc @bagder

[bagder]

OpenSSL 1.0.2 was first released on 22 January 2015, which makes it a nice round number: we drop support for the OpenSSL versions released > 10 years ago.

No one building modern systems that care for security and functionality use anything older. Those who do, they probably use older libcurl versions as well. I think this is a good change.

[vszakats]

I bumped the minimum to 1.0.2a (2015-03-19), because it allowed to
drop a block of code working around a 1.0.2 (initial release) bug.
Ref: 424619b 4155f5d#diff-03eaf320162ec20f67fab4e16f494e29735dadfa12425530869d42eea86bd2ccL2530

It should be trivial (and much recommended) to use the latest bugfix
release of any given major version, e.g. 1.0.2u.

(The 10 years will also stand when this PR gets into the next release.)