Package: openssl
Version: 3.6.5-1
Severity: wishlist
Hello.
Debian's /etc/ssl/openssl.cnf includes no directory, so a package that ships an
OpenSSL provider (openssl-provider-fips, pkcs11-provider, tpm2-openssl,
openssl-provider-qat) cannot activate it system-wide without the administrator
editing the conffile.
Would you consider ending the file with `.include /etc/ssl/openssl.cnf.d` and
shipping that directory empty?
In Sparky Stereo OS, a SparkyLinux edition, we ship an Ed521 verification
provider for ICP-Brasil's root v7, and today we divert /usr/lib/ssl/openssl.cnf
to reach it, which we would rather not do.
A snippet must also activate the default provider, because activating any
provider turns the implicit default off; we can propose the wording and tests.
Prepared with AI assistance (Claude), reviewed by me.
Daniel Campos Ramos
