Compile-time disable weak curves in TLS by default in 4.0
RFC 8422 has deprecated some weak elliptic curves in TLS. We have a compiling option to disable them in openssl. I propose to make these curves disabled in compile time by default in 4.0.
See for more details https://github.com/openssl/openssl/pull/29658
Compile-time disable weak curves in TLS by default in 4.0
poll by Dmitry Belyavsky Closed Sun 25 Jan 2026 12:00PM
Choose the option(s) you favor.
Results
| Results | Option | % of points | Voters | |||
|---|---|---|---|---|---|---|
| Yes | 92 | 12 |     | |||
| No | 8 | 1 |  | |||
| Not voted | 15 |           |
No
I've no problem disabling weak curves in general, but it seems to me, changing defaults seems like something that should be done at the start of a development cycle, rather than so close to the end. By doing it now we risk upsetting any behavioral testing that the community has been undertaking immediately prior to release
I think those are in reality practically unused, so I do not see a problem with these being disabled by default in 4.0.