Skip to content

doc: doc-only deprecate OpenSSL engine-based APIs - #53329

Merged
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
richardlau:deprecate_openssl_engines
Jun 7, 2024
Merged

doc: doc-only deprecate OpenSSL engine-based APIs#53329
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
richardlau:deprecate_openssl_engines

Conversation

@richardlau

@richardlau richardlau commented Jun 4, 2024 •
edited
Loading

Copy link
Copy Markdown
Member

OpenSSL 3 deprecated support for custom engines with a recommendation to switch to its new provider model.
The clientCertEngine option for https.request(), tls.createSecureContext(), and tls.createServer(); the privateKeyEngine and privateKeyIdentifier for tls.createSecureContext(); and crypto.setEngine() all depend on this functionality from OpenSSL.

@nodejs-github-bot

nodejs-github-bot commented Jun 4, 2024

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/crypto

@nodejs-github-bot nodejs-github-bot added the doc Issues and PRs related to Node.js documentation. label Jun 4, 2024
@avivkeller avivkeller added crypto Issues and PRs related to the crypto subsystem. openssl Issues and PRs related to the OpenSSL dependency. and removed crypto Issues and PRs related to the crypto subsystem. labels Jun 4, 2024
@avivkeller

avivkeller commented Jun 4, 2024

Copy link
Copy Markdown
Member

(ignore the crypto label, oops)

avivkeller
avivkeller reviewed Jun 4, 2024
View reviewed changes
Comment thread doc/api/tls.md Outdated
avivkeller
avivkeller approved these changes Jun 4, 2024
View reviewed changes

@avivkeller avivkeller left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tip

I'm not a core-collaborator, so this is non-blocking/approving

@richardlau

richardlau commented Jun 4, 2024 •
edited
Loading

Copy link
Copy Markdown
Member Author

In terms of timeframes, https://mta.openssl.org/pipermail/openssl-users/2023-November/016852.html from last November indicated that since OpenSSL now follows semver, the earliest OpenSSL could remove the engine API is OpenSSL 4 for which there is no plan for when that would be released.

There is no date set for that yet. Not even roughly. The earliest
release where the engine API can be removed is 4.0 but there was no
decision on when that version is going to be released and it was not
even decided which of the deprecated APIs are going to be removed in
4.0.

The functions deprecated in 3.0 will remain supported in 3.0 until
2026-09-07. If there is any further 3.x version designated as LTS, it
will give the lifetime of these APIs at least further five years. But
it wasn't decided yet whether there will be another 3.x version
designated as LTS.

Anyone building Node.js themselves today and linking to OpenSSL 3 configured with no-engine would not have OpenSSL engine support available and will get the documented ERR_CRYPTO_CUSTOM_ENGINE_NOT_SUPPORTED error when trying to use a Node.js API that depends on OpenSSL engine support.

tniessen
tniessen approved these changes Jun 4, 2024
View reviewed changes

@tniessen tniessen left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Doc-only deprecation is fine by me, as long as nobody moves this towards a runtime deprecation for no reason. We should definitely try to better accommodate OpenSSL 3 providers.

@richardlau richardlau added the notable-change PRs with changes that should be highlighted in changelogs. label Jun 4, 2024
@github-actions

github-actions Bot commented Jun 4, 2024

Copy link
Copy Markdown
Contributor

The notable-change PRs with changes that should be highlighted in changelogs. label has been added by @richardlau.

Please suggest a text for the release notes if you'd like to include a more detailed summary, then proceed to update the PR description with the text or a link to the notable change suggested text comment. Otherwise, the commit will be placed in the Other Notable Changes section.

VoltrexKeyva
VoltrexKeyva reviewed Jun 4, 2024
View reviewed changes
Comment thread doc/api/deprecations.md Outdated
@richardlau
doc: doc-only deprecate OpenSSL engine-based APIs
91390c2 
OpenSSL 3 deprecated support for custom engines with a recommendation
to switch to its new provider model.
@richardlau
richardlau force-pushed the deprecate_openssl_engines branch from 28ea741 to 91390c2 Compare June 4, 2024 17:59
@richardlau richardlau changed the title doc: doc-only deprecate OpenSSL engine based APIs doc: doc-only deprecate OpenSSL engine-based APIs Jun 4, 2024
@richardlau richardlau added author ready PRs with CI started, the required approvals, and no outstanding review comments. commit-queue PRs queued for automated landing through the Commit Queue. labels Jun 5, 2024
@nodejs-github-bot nodejs-github-bot removed the commit-queue PRs queued for automated landing through the Commit Queue. label Jun 7, 2024
@nodejs-github-bot
nodejs-github-bot merged commit 5291b0e into nodejs:main Jun 7, 2024
@nodejs-github-bot

nodejs-github-bot commented Jun 7, 2024

Copy link
Copy Markdown
Collaborator

Landed in 5291b0e

@richardlau
richardlau deleted the deprecate_openssl_engines branch June 11, 2024 16:09
targos pushed a commit that referenced this pull request Jun 20, 2024
@richardlau @targos
doc: doc-only deprecate OpenSSL engine-based APIs
df47627 
OpenSSL 3 deprecated support for custom engines with a recommendation
to switch to its new provider model.

PR-URL: #53329
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
eliphazbouye pushed a commit to eliphazbouye/node that referenced this pull request Jun 20, 2024
@richardlau @eliphazbouye
doc: doc-only deprecate OpenSSL engine-based APIs
494d7ae 
OpenSSL 3 deprecated support for custom engines with a recommendation
to switch to its new provider model.

PR-URL: nodejs#53329
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
targos added a commit that referenced this pull request Jun 25, 2024
@targos
2024-06-26, Version 22.4.0 (Current)
8efb279 
Notable changes:

deps,lib,src:
  * (SEMVER-MINOR) add experimental web storage (Colin Ihrig) #52435
doc:
  * move `node --run` stability to rc (Yagiz Nizipli) #53433
  * mark WebSocket as stable (Matthew Aitken) #53352
  * mark --heap-prof and related flags stable (Joyee Cheung) #53343
  * mark --cpu-prof and related flags stable (Joyee Cheung) #53343
  * doc-only deprecate OpenSSL engine-based APIs (Richard Lau) #53329
inspector:
  * fix disable async hooks on Debugger.setAsyncCallStackDepth (Joyee Cheung) #53473
lib:
  * (SEMVER-MINOR) add diagnostics_channel events to module loading (RafaelGSS) #44340
util:
  * (SEMVER-MINOR) support `--no-` for argument with boolean type for parseArgs (Zhenwei Jin) #53107

PR-URL: #53583
@targos targos mentioned this pull request Jun 25, 2024
Merged
targos added a commit that referenced this pull request Jun 26, 2024
@targos
2024-06-26, Version 22.4.0 (Current)
e7e7e93 
Notable changes:

deps,lib,src:
  * (SEMVER-MINOR) add experimental web storage (Colin Ihrig) #52435
doc:
  * move `node --run` stability to rc (Yagiz Nizipli) #53433
  * mark WebSocket as stable (Matthew Aitken) #53352
  * mark --heap-prof and related flags stable (Joyee Cheung) #53343
  * mark --cpu-prof and related flags stable (Joyee Cheung) #53343
  * doc-only deprecate OpenSSL engine-based APIs (Richard Lau) #53329
inspector:
  * fix disable async hooks on Debugger.setAsyncCallStackDepth (Joyee Cheung) #53473
lib:
  * (SEMVER-MINOR) add diagnostics_channel events to module loading (RafaelGSS) #44340
util:
  * (SEMVER-MINOR) support `--no-` for argument with boolean type for parseArgs (Zhenwei Jin) #53107

PR-URL: #53583
targos added a commit that referenced this pull request Jul 1, 2024
@targos
2024-07-02, Version 22.4.0 (Current)
7e13cc5 
Notable changes:

deps,lib,src:
  * (SEMVER-MINOR) add experimental web storage (Colin Ihrig) #52435
doc:
  * move `node --run` stability to rc (Yagiz Nizipli) #53433
  * mark WebSocket as stable (Matthew Aitken) #53352
  * mark --heap-prof and related flags stable (Joyee Cheung) #53343
  * mark --cpu-prof and related flags stable (Joyee Cheung) #53343
  * doc-only deprecate OpenSSL engine-based APIs (Richard Lau) #53329
inspector:
  * fix disable async hooks on Debugger.setAsyncCallStackDepth (Joyee Cheung) #53473
lib:
  * (SEMVER-MINOR) add diagnostics_channel events to module loading (RafaelGSS) #44340
util:
  * (SEMVER-MINOR) support `--no-` for argument with boolean type for parseArgs (Zhenwei Jin) #53107

PR-URL: #53583
targos added a commit that referenced this pull request Jul 2, 2024
@targos
2024-07-02, Version 22.4.0 (Current)
056f055 
Notable changes:

deps,lib,src:
  * (SEMVER-MINOR) add experimental web storage (Colin Ihrig) #52435
doc:
  * move `node --run` stability to rc (Yagiz Nizipli) #53433
  * mark WebSocket as stable (Matthew Aitken) #53352
  * mark --heap-prof and related flags stable (Joyee Cheung) #53343
  * mark --cpu-prof and related flags stable (Joyee Cheung) #53343
  * doc-only deprecate OpenSSL engine-based APIs (Richard Lau) #53329
inspector:
  * fix disable async hooks on Debugger.setAsyncCallStackDepth (Joyee Cheung) #53473
lib:
  * (SEMVER-MINOR) add diagnostics_channel events to module loading (RafaelGSS) #44340
util:
  * (SEMVER-MINOR) support `--no-` for argument with boolean type for parseArgs (Zhenwei Jin) #53107

PR-URL: #53583
@Karliz24 Karliz24 mentioned this pull request Jul 9, 2024
Open
marco-ippolito pushed a commit that referenced this pull request Jul 19, 2024
@richardlau @marco-ippolito
doc: doc-only deprecate OpenSSL engine-based APIs
3445c08 
OpenSSL 3 deprecated support for custom engines with a recommendation
to switch to its new provider model.

PR-URL: #53329
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
@marco-ippolito marco-ippolito mentioned this pull request Jul 19, 2024
Merged
marco-ippolito added a commit that referenced this pull request Jul 19, 2024
@marco-ippolito
2024-07-24, Version 20.16.0 'Iron' (LTS)
7d0c53d 
Notable changes:

buffer:
  * (SEMVER-MINOR) add .bytes() method to Blob (Matthew Aitken) #53221
doc:
  * doc-only deprecate OpenSSL engine-based APIs (Richard Lau) #53329
  * (SEMVER-MINOR) add context.assert docs (Colin Ihrig) #53169
  * (SEMVER-MINOR) improve explanation about built-in modules (Joyee Cheung) #52762
  * add StefanStojanovic to collaborators (StefanStojanovic) #53118
  * add Marco Ippolito to TSC (Rafael Gonzaga) #53008
inspector:
  * fix disable async hooks on Debugger.setAsyncCallStackDepth (Joyee Cheung) #53473
net:
  * (SEMVER-MINOR) add new net.server.listen tracing channel (Paolo Insogna) #53136
process:
  * (SEMVER-MINOR) add process.getBuiltinModule(id) (Joyee Cheung) #52762
src,permission:
  * (SEMVER-MINOR) --allow-wasi & prevent WASI exec (Rafael Gonzaga) #53124
test_runner:
  * (SEMVER-MINOR) add context.fullName (Colin Ihrig) #53169
util:
  * (SEMVER-MINOR) support `--no-` for argument with boolean type for parseArgs (Zhenwei Jin) #53107

PR-URL: #53945
marco-ippolito added a commit that referenced this pull request Jul 21, 2024
@marco-ippolito
2024-07-24, Version 20.16.0 'Iron' (LTS)
1968ef3 
Notable changes:

buffer:
  * (SEMVER-MINOR) add .bytes() method to Blob (Matthew Aitken) #53221
doc:
  * doc-only deprecate OpenSSL engine-based APIs (Richard Lau) #53329
  * (SEMVER-MINOR) add context.assert docs (Colin Ihrig) #53169
  * (SEMVER-MINOR) improve explanation about built-in modules (Joyee Cheung) #52762
  * add StefanStojanovic to collaborators (StefanStojanovic) #53118
  * add Marco Ippolito to TSC (Rafael Gonzaga) #53008
inspector:
  * fix disable async hooks on Debugger.setAsyncCallStackDepth (Joyee Cheung) #53473
net:
  * (SEMVER-MINOR) add new net.server.listen tracing channel (Paolo Insogna) #53136
process:
  * (SEMVER-MINOR) add process.getBuiltinModule(id) (Joyee Cheung) #52762
src,permission:
  * (SEMVER-MINOR) --allow-wasi & prevent WASI exec (Rafael Gonzaga) #53124
test_runner:
  * (SEMVER-MINOR) add context.fullName (Colin Ihrig) #53169
util:
  * (SEMVER-MINOR) support `--no-` for argument with boolean type for parseArgs (Zhenwei Jin) #53107

PR-URL: #53945
marco-ippolito added a commit that referenced this pull request Jul 24, 2024
@marco-ippolito
2024-07-24, Version 20.16.0 'Iron' (LTS)
7a6185d 
Notable changes:

buffer:
  * (SEMVER-MINOR) add .bytes() method to Blob (Matthew Aitken) #53221
doc:
  * doc-only deprecate OpenSSL engine-based APIs (Richard Lau) #53329
  * (SEMVER-MINOR) add context.assert docs (Colin Ihrig) #53169
  * (SEMVER-MINOR) improve explanation about built-in modules (Joyee Cheung) #52762
  * add StefanStojanovic to collaborators (StefanStojanovic) #53118
  * add Marco Ippolito to TSC (Rafael Gonzaga) #53008
inspector:
  * fix disable async hooks on Debugger.setAsyncCallStackDepth (Joyee Cheung) #53473
net:
  * (SEMVER-MINOR) add new net.server.listen tracing channel (Paolo Insogna) #53136
process:
  * (SEMVER-MINOR) add process.getBuiltinModule(id) (Joyee Cheung) #52762
src,permission:
  * (SEMVER-MINOR) --allow-wasi & prevent WASI exec (Rafael Gonzaga) #53124
test_runner:
  * (SEMVER-MINOR) add context.fullName (Colin Ihrig) #53169
util:
  * (SEMVER-MINOR) support `--no-` for argument with boolean type for parseArgs (Zhenwei Jin) #53107

PR-URL: #53945
@panva panva mentioned this pull request Aug 27, 2026
Closed
@aduh95 aduh95 mentioned this pull request Sep 2, 2026
Merged
aduh95 added a commit that referenced this pull request Sep 4, 2026
@aduh95 @panva
doc: add stability status to crypto.setEngine (#65746)
4fc60f4 
It's been doc-deprecated (DEP0183) for a while.

PR-URL: #65746
Refs: #53329
Co-authored-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
aduh95 added a commit that referenced this pull request Sep 7, 2026
@aduh95 @panva
doc: add stability status to crypto.setEngine
fa4bc30 
It's been doc-deprecated (DEP0183) for a while.

PR-URL: #65746
Refs: #53329
Co-authored-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
R31K4G3 pushed a commit to R31K4G3/node that referenced this pull request Sep 9, 2026
@aduh95 @panva
doc: add stability status to crypto.setEngine
5f64847 
It's been doc-deprecated (DEP0183) for a while.

PR-URL: nodejs#65746
Refs: nodejs#53329
Co-authored-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
aduh95 added a commit that referenced this pull request Sep 9, 2026
@aduh95 @panva
doc: add stability status to crypto.setEngine
f6a237c 
It's been doc-deprecated (DEP0183) for a while.

PR-URL: #65746
Refs: #53329
Co-authored-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
aduh95 added a commit that referenced this pull request Sep 9, 2026
@aduh95 @panva
doc: add stability status to crypto.setEngine
f982a53 
It's been doc-deprecated (DEP0183) for a while.

PR-URL: #65746
Refs: #53329
Co-authored-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
panva added a commit that referenced this pull request Oct 25, 2026
@panva
build: require OpenSSL 3 or later
34e3b90 
configure now fails when --shared-openssl points at OpenSSL 1.x rather
than failing later at compile or link time. The check skips BoringSSL,
whose version macros claim 1.1.1.

Stop setting the OpenSSL 1.1 API compatibility level for bundled builds.
ncrypto selects the supported API level directly.

Update the assembler capability check, shared-library test matrix,
package fallbacks, and internal version-number typing for the new
baseline.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #64777
Fixes: #56733
Refs: #64211
Refs: #63966
Refs: #53329
Refs: #48950
Refs: #45465
Refs: #42827
Refs: #47076
Refs: #62862
Refs: #38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
panva added a commit that referenced this pull request Oct 25, 2026
@panva
deps: remove ncrypto legacy OpenSSL backend
85bfe9a 
Remove the OpenSSL 1.x backend and its legacy dss1 digest aliases.
Rename the provider-backed path switch to NCRYPTO_USE_OPENSSL_PROVIDER
and rewrite the remaining version guards as OPENSSL_IS_BORINGSSL checks.

Remove version-adapter casts now that supported OpenSSL signatures are
uniform. Drop legacy digest-context, raw-key, seed, signature-context,
SM2, primality, and RSA2 key-detail fallbacks. Keep name-based key
algorithms and capability discovery, with numeric key adapters and
low-level key paths only for BoringSSL.

Use the same backend split for KDFs, PKCS#1 decoding, key serialization,
and provider EC/RSA key details. Gate BoringSSL-only alternatives
explicitly instead of leaving them in #else branches.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #64777
Fixes: #56733
Refs: #64211
Refs: #63966
Refs: #53329
Refs: #48950
Refs: #45465
Refs: #42827
Refs: #47076
Refs: #62862
Refs: #38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
panva added a commit that referenced this pull request Oct 25, 2026
@panva
crypto: remove legacy OpenSSL code paths
8be36fb 
Remove the OpenSSL 1.x branches and stale version-specific assumptions
from src/. BoringSSL does not define OPENSSL_VERSION_MAJOR, so the
remaining version guards were excluding it as well; use
OPENSSL_IS_BORINGSSL checks instead, including the shared PKCS12 parser
and TLS PFX error handling.

Gate BoringSSL-only alternatives explicitly instead of leaving them
in #else branches, including the MAC/KMAC and OCB fallbacks. Fix the
BoringSSL guard on QUIC's unsupported-backend diagnostic.

Make the OpenSSL legacy-provider command-line help version-neutral.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #64777
Fixes: #56733
Refs: #64211
Refs: #63966
Refs: #53329
Refs: #48950
Refs: #45465
Refs: #42827
Refs: #47076
Refs: #62862
Refs: #38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
panva added a commit that referenced this pull request Oct 25, 2026
@panva
test,benchmark: drop OpenSSL 1.x-only coverage
acbc3ff 
Delete test-crypto-ecb.js, which can no longer run anywhere: Blowfish
is available only from OpenSSL's legacy provider and is absent from
BoringSSL.

The addon and cctest version guards become OPENSSL_IS_BORINGSSL checks.
Remove legacy digest-alias coverage and unreachable OpenSSL 1.x
branches. JavaScript test and benchmark gates, skip reasons, and TLS
error expectations that distinguished OpenSSL 1.x from provider-backed
OpenSSL now distinguish BoringSSL, including PKCS12 parsing, named DH
groups, private-key serialization, RSA-PSS parameters, consolidated
provider caches, FIPS availability, and empty KMAC output. Keep the CCM
alternate finalization error only for BoringSSL.

Provider-only test skips use version-neutral terminology or state the
actual minimum OpenSSL version.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #64777
Fixes: #56733
Refs: #64211
Refs: #63966
Refs: #53329
Refs: #48950
Refs: #45465
Refs: #42827
Refs: #47076
Refs: #62862
Refs: #38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
panva added a commit that referenced this pull request Oct 25, 2026
@panva
doc: remove OpenSSL 1.x references
7f16850 
Rename the openssl30 footnote, which marks APIs unavailable on
BoringSSL rather than ones requiring OpenSSL. Remove obsolete version
qualifiers from the provider and FIPS documentation, drop the "As of
OpenSSL 1.1.0" anchor from the PSK size limits, and point the man1.1.1
links at man3.0.

Document BoringSSL as the only backend with numeric key adapters.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #64777
Fixes: #56733
Refs: #64211
Refs: #63966
Refs: #53329
Refs: #48950
Refs: #45465
Refs: #42827
Refs: #47076
Refs: #62862
Refs: #38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
panva added a commit that referenced this pull request Oct 25, 2026
@panva
test,tools: drop OpenSSL 1.x-era FIPS leftovers
ee9ae88 
The openssl_fips_*.cnf fixtures use OpenSSL 1.x syntax, and their test
branches can no longer run. Remove the fixtures and related version
gates while keeping the provider-backed FIPS assertions.

get_env_type() sniffed for a "-fips" version suffix that can no longer
occur, and the crypto-check lint rule listed a helper that no longer
exists.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #64777
Fixes: #56733
Refs: #64211
Refs: #63966
Refs: #53329
Refs: #48950
Refs: #45465
Refs: #42827
Refs: #47076
Refs: #62862
Refs: #38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
panva added a commit that referenced this pull request Oct 25, 2026
@panva
build: remove the bundled FIPS provider build
21cfb2a 
--openssl-is-fips with bundled OpenSSL never worked: the
openssl-fipsmodule target had no dependency edge, so fipsinstall's
input was produced by nothing. Repairing it would not help, since a
FIPS provider built out of tree has no validation status.

Remove the machinery and restrict --openssl-is-fips to --shared-openssl.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #64777
Fixes: #56733
Refs: #64211
Refs: #63966
Refs: #53329
Refs: #48950
Refs: #45465
Refs: #42827
Refs: #47076
Refs: #62862
Refs: #38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
panva added a commit that referenced this pull request Oct 25, 2026
@panva
crypto: move DEP0093 to End-of-Life
fb8d52d 
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #64777
Fixes: #56733
Refs: #64211
Refs: #63966
Refs: #53329
Refs: #48950
Refs: #45465
Refs: #42827
Refs: #47076
Refs: #62862
Refs: #38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
panva added a commit that referenced this pull request Oct 25, 2026
@panva
Revert "crypto,https,tls: runtime-deprecate OpenSSL engine-based APIs…
b61e682 
… (DEP0183)"

This reverts commit da51692.

PR-URL: #64777
Fixes: #56733
Refs: #64211
Refs: #63966
Refs: #53329
Refs: #48950
Refs: #45465
Refs: #42827
Refs: #47076
Refs: #62862
Refs: #38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
panva added a commit that referenced this pull request Oct 25, 2026
@panva
crypto,https,tls: end OpenSSL engine support
a2cd8aa 
OpenSSL removed support for engines in version 4. Remove the Node.js
APIs, constants, native bindings, and implementation that depend on
ENGINE.

Keep recognizing the former TLS and HTTPS engine options so their use
fails explicitly instead of appearing to work while being ignored.

Move DEP0183 directly from Documentation-only to End-of-Life after
reverting its unreleased Runtime deprecation.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #64777
Fixes: #56733
Refs: #64211
Refs: #63966
Refs: #53329
Refs: #48950
Refs: #45465
Refs: #42827
Refs: #47076
Refs: #62862
Refs: #38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lpinca lpinca lpinca approved these changes
@tniessen tniessen tniessen approved these changes
@avivkeller avivkeller avivkeller approved these changes
+1 more reviewer
@VoltrexKeyva VoltrexKeyva VoltrexKeyva approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

author ready PRs with CI started, the required approvals, and no outstanding review comments. doc Issues and PRs related to Node.js documentation. notable-change PRs with changes that should be highlighted in changelogs. openssl Issues and PRs related to the OpenSSL dependency.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@richardlau @nodejs-github-bot @avivkeller @lpinca @tniessen @VoltrexKeyva