OpenSSL Communities
Mon 22 Sep 2025 9:32AM

How do default values in the OpenSSL code base get changed?

MB Michael Baentsch Public Seen by 12

OpenSSL contains many default values in its code base, e.g., for [default TLS groups](https://openssl-communities.org/d/dpuCvbRz/post-quantum-cryptography-pqc-group-recommendations-for-tls-1-3/15). These default values are valid only at a given point in time and may change as for example, needs, risks or standards change.

This discussion thus is to request a documentation to a "recommended procedure" how changes to these values can be initiated: Is this always simply by way of a GH PR or would TACs/BACs need to be involved? If the latter, how?

If different procedures are considered sensible for different defaults (arguably advisable) should there be a list of all defaults and the way each can get changed in the project (or outside it, e.g., if they are linked to a standard)? Maybe also sensible would be a documented link to the person(s) most likely to comment on a proposed default value change (or a link to the code base for each default such as to check `git blame` who last changed it).

If this already exists, apologies for the noise and thanks in advance for a pointer to it.