#ressl

[opensslrampage]

Add ressl_config_clear_keys()

Provide a ressl config function that explicitly clears keys. Now that ressl config takes copies of the keys passed to it, the keys need to be explicitly cleared. While this can be done by calling the appropriate functions with a NULL pointer, it is simpler and more obvious to call one function that does this for you.

— jsing

[pipefail]

Ressl sounds like a great idea. Making implementation of good security in apps trivial without OpenSSL bullshit abstractions getting leaked all over your pants? Sounds fucking rad.

[opensslrampage]

Add SSL_CTX_use_certificate_chain()

Add a new API function SSL_CTX_use_certificate_chain() that allows to read the PEM-encoded certificate chain from memory instead of a file. This idea is derived from an older implementation in relayd that was needed to use the function with a privep'ed process in a chroot. Now it is time to get it into LibreSSL to make the API more privsep- friendly and to make it available for other programs and the ressl library.

— reyk

[opensslrampage]

Config interface should own its own memory

revamp the config interface to own memory. easier to use correctly without caller worrying about leaks or lifetimes.

— tedu