On 2026-10-29 18:35:06 [-0300], Daniel Ramos wrote: > Hello. > Debian's /etc/ssl/openssl.cnf includes no directory, so a package that ships > an OpenSSL provider (openssl-provider-fips, pkcs11-provider, tpm2-openssl, > openssl-provider-qat) cannot activate it system-wide without the > administrator editing the conffile. > Would you consider ending the file with `.include /etc/ssl/openssl.cnf.d` and > shipping that directory empty? > In Sparky Stereo OS, a SparkyLinux edition, we ship an Ed521 verification > provider for ICP-Brasil's root v7, and today we divert > /usr/lib/ssl/openssl.cnf to reach it, which we would rather not do. > A snippet must also activate the default provider, because activating any > provider turns the implicit default off; we can propose the wording and tests. > Prepared with AI assistance (Claude), reviewed by me.
could you please send a patch what you had in mind? > Daniel Campos Ramos Sebastian
