1.0.2 Not considering Curves in openssl.cnf

[kothabhaskar]

Hi All,
I am new and exploring openssl.
I was testing 'openssl s_server' and 'openssl s_client' in the openssl version 1.0.2z
I have added the Curves into openssl.cnf
openssl.cnf:

Curves = P-521:P-384:P-256

The above openssl option example checked in demo code.
But when i was connection client and server, i suppose to get
Supported Elliptic Curves: P-521:P-384:P-256
Shared Elliptic curves: P-521:P-384:P-256

But i am seeing
Supported Elliptic Curves: P-256:P-521:brainpoolP512r1:brainpoolP384r1:P-384:brainpoolP256r1:secp256k1:B-571:K-571:K-409:B-409:K-283:B-283
Shared Elliptic curves: P-256:P-521:brainpoolP512r1:brainpoolP384r1:P-384:brainpoolP256r1:secp256k1:B-571:K-571:K-409:B-409:K-283:B-283

It means, not honouring the openssl.cnf values, but verified with strace its loading proper openssl.cnf file path varified.

Can we know is that expected behavior? or do we have any patch or fix to read from the the openssl.cnf Curve values.

[mattcaswell]

the openssl version 1.0.2z

Are you sure? There is no such version as 1.0.2z. The last publicly available version of OpenSSL 1.0.2 is 1.0.2u. Later versions are available to premium support customers only. The next version after 1.0.2y was 1.0.2za. Perhaps this is what you mean? If you are a premium support customer then please raise a support query for this via our support system. Otherwise 1.0.2 is end of life and no longer supported.

[t8m]

Please note that 1.0.2 does not apply the default settings from the config file to the SSL_CTX. This was added later.

[kothabhaskar]

Thankyou for Reply, Can i know from which version the support added, so i can update to that version and test..

[t8m]

You can try 1.1.1 that is the oldest still supported. Or 3.1 if you want something new.