OpenSSL 4.0 Configuration

This is a summary of available algorithms in Chainguard OpenSSL 4.0 (non-fips) and Chainguard FIPS Provider for OpenSSL 3.6.

The majority of the available algorithms are not enabled by default and are only available with manual overrides, configuration, and reduction of default security level of 2, to a lower value. Those that are available in FIPS also require manual overrides and configuration.

The v4.0 and FIPS v3.6 columns read as follows:

• Default: negotiated by default under the shipped Chainguard OS crypto policy. For key exchange groups, First marks the most preferred group and Preshare the group whose key share is sent in the first ClientHello.
• Available: works, but only with manual configuration.
• Non-TLS only: the elliptic curve works for keys, signatures and certificates, but has no TLS supported group and so cannot be used in TLS.
• Blank: not available.

The tables are presented in the format similar to the IANA TLS Parameters.

For more information about Transport Layer Security (TLS) please see the following references:

• NIST PQC
• RFC10024
• draft-ietf-tls-mldsa
• RFC10015
• BCP 195
• RFC 9846
• RFC 5246
• NIST SP 800-52 Rev. 2
• RFC 9151
• draft-becker-cnsa2-tls-profile

TLS Cipher Suites

TLS Supported Groups

The brainpool rows combine two codepoints each: the first one (brainpoolP256r1, brainpoolP384r1, brainpoolP512r1) is what TLS 1.2 negotiates, the second one (brainpoolP256r1tls13, brainpoolP384r1tls13, brainpoolP512r1tls13) is the TLS 1.3 name of the same curve.

TLS SignatureScheme

Elliptic Curves