Hello, My organization is using gRPC primarily with C++, Python, and C#, and we have a few challenges related to SSL. We're under a restriction that we do not redistribute any ThirdParty code that has any CVE. For this reason we cannot distribute OpenSSL 1.0.0 (we must use 1.1.0).
We were able to build gRPC against OpenSSL 1.1.0 on both windows and linux using the patch from this github issue <https://github.com/grpc/grpc/issues/8801>, although many tests fail. (Is there any version targeted to support this officially?) Another option would be to use BoringSSL. AFAIK there are no CVEs against the version of BoringSSL that gRPC uses. However, this could be challenging because we use OpenSSL with python for things other than gRPC. We won't be able to link both, so my question here is are there any known libraries/wrappers which use BoringSSL directly from CPython and are they swap-in replacements for the OpenSSL equivalent? Thanks! Mohamed Koubaa Software Developer ANSYS, Inc -- You received this message because you are subscribed to the Google Groups "grpc.io" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. Visit this group at https://groups.google.com/group/grpc-io. To view this discussion on the web visit https://groups.google.com/d/msgid/grpc-io/CAJBOL5ttgWnFaq1G5y4ECon7Qe3yvvRE_gmmr-GscsD%2BX_xANQ%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
