'Can we stop an application integrated with OpenSSL from using openssl.conf/.cnf file using compile time option?
An application integrated with OpenSSL should not read openssl.cnf file. This is a security risk.
Have came across OPENSSL_init_crypto(OPENSSL_INIT_NO_LOAD_CONFIG, NULL); but cannot use it since the application has CURL too which internally initializes OpenSSL.
Thus, only CURL is initialized but both OpenSSL and CURL are used simultaneously.
I did check out the Configure file of OpenSSL to look for compile time switch but did not find any.
Solution 1:[1]
no-autoload-config option can be used during compilation
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|---|
| Solution 1 | dpb |