romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-01 13:48:19 +03:00
Code Issues Projects Releases Packages Wiki Activity

TLS: remove support for Secure Transport and BearSSL

Browse source 
These libraries do not support TLS 1.3 and have been marked for removal
for over a year. We want to help users select a TLS dependency that is
future-proof and reliable, and not supporting TLS 1.3 in 2025 does not
infer confidence. Users who build libcurl are likely to be served better
and get something more future-proof with a TLS library that supports
1.3.

Closes #16677
This commit is contained in:
Daniel Stenberg 2025-06-09 14:07:21 +02:00
parent b761eb5add
commit 08a3e8e19a
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
89 changed files with 163 additions and 5036 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tests/data/test2088
View file

@ -26,8 +26,6 @@ MooMoo
<features>
SSL
!Schannel
!sectransp
!bearssl
local-http
</features>
<server>

1
tests/data/test3102
View file

@ -19,7 +19,6 @@ HTTP GET
# SSL with libraries supporting CURLOPT_CERTINFO
<features>
SSL
!bearssl
!wolfssl
</features>
<server>

2
tests/data/test313
View file

@ -14,9 +14,7 @@ CRL
<features>
SSL
local-http
!bearssl
!Schannel
!sectransp
!wolfssl
</features>
<server>

1
tests/data/test417
View file

@ -24,7 +24,6 @@ nomnom
<features>
SSL
!wolfssl
!bearssl
!mbedtls
</features>
<server>

1
tests/http/test_10_proxy.py
View file

@ -363,7 +363,6 @@ class TestProxy:
# download via https: proxy (no tunnel) using IP address
@pytest.mark.skipif(condition=not Env.curl_has_feature('HTTPS-proxy'),
reason='curl lacks HTTPS-proxy support')
@pytest.mark.skipif(condition=Env.curl_uses_lib('bearssl'), reason="ip address cert verification not supported")
@pytest.mark.parametrize("proto", ['http/1.1', 'h2'])
def test_10_14_proxys_ip_addr(self, env: Env, httpd, proto):
if proto == 'h2' and not env.curl_uses_lib('nghttp2'):

20
tests/http/test_17_ssl_use.py
View file

@ -63,8 +63,6 @@ class TestSSLUse:
exp_resumed = 'Initial' # 1.2 works in LibreSSL, but 1.3 does not, TODO
if env.curl_uses_lib('rustls-ffi'):
exp_resumed = 'Initial' # Rustls does not support sessions, TODO
if env.curl_uses_lib('bearssl') and tls_max == '1.3':
pytest.skip('BearSSL does not support TLSv1.3')
if env.curl_uses_lib('mbedtls') and tls_max == '1.3' and \
not env.curl_lib_version_at_least('mbedtls', '3.6.0'):
pytest.skip('mbedtls TLSv1.3 session resume not working in 3.6.0')
@ -132,8 +130,6 @@ class TestSSLUse:
# use ip address for connect
@pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
def test_17_05_good_ip_addr(self, env: Env, proto, httpd, nghttpx):
if env.curl_uses_lib('bearssl'):
pytest.skip("BearSSL does not support cert verification with IP addresses")
if env.curl_uses_lib('mbedtls'):
pytest.skip("mbedTLS does use IP addresses in SNI")
if proto == 'h3' and not env.have_h3():
@ -235,17 +231,9 @@ class TestSSLUse:
elif env.curl_uses_lib('schannel'): # not in CI, so untested
if ciphers12 is not None:
pytest.skip('Schannel does not support setting TLSv1.2 ciphers by name')
elif env.curl_uses_lib('bearssl'):
if tls_proto == 'TLSv1.3':
pytest.skip('BearSSL does not support TLSv1.3')
tls_proto = 'TLSv1.2'
elif env.curl_uses_lib('mbedtls') and not env.curl_lib_version_at_least('mbedtls', '3.6.0'):
if tls_proto == 'TLSv1.3':
pytest.skip('mbedTLS < 3.6.0 does not support TLSv1.3')
elif env.curl_uses_lib('sectransp'): # not in CI, so untested
if tls_proto == 'TLSv1.3':
pytest.skip('Secure Transport does not support TLSv1.3')
tls_proto = 'TLSv1.2'
# test
extra_args = ['--tls13-ciphers', ':'.join(ciphers13)] if ciphers13 else []
extra_args += ['--ciphers', ':'.join(ciphers12)] if ciphers12 else []
@ -308,11 +296,7 @@ class TestSSLUse:
curl = CurlClient(env=env, run_env=run_env)
url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
# SSL backend specifics
if env.curl_uses_lib('bearssl'):
supported = ['TLSv1', 'TLSv1.1', 'TLSv1.2', None]
elif env.curl_uses_lib('sectransp'): # not in CI, so untested
supported = ['TLSv1', 'TLSv1.1', 'TLSv1.2', None]
elif env.curl_uses_lib('gnutls'):
if env.curl_uses_lib('gnutls'):
supported = ['TLSv1', 'TLSv1.1', 'TLSv1.2', 'TLSv1.3']
elif env.curl_uses_lib('quiche'):
supported = ['TLSv1', 'TLSv1.1', 'TLSv1.2', 'TLSv1.3']
@ -420,8 +404,6 @@ class TestSSLUse:
pytest.skip('Libressl resumption does not work inTLSv1.3')
if env.curl_uses_lib('rustls-ffi'):
pytest.skip('rustsls does not expose sessions')
if env.curl_uses_lib('bearssl'):
pytest.skip('BearSSL does not support TLSv1.3')
if env.curl_uses_lib('mbedtls') and \
not env.curl_lib_version_at_least('mbedtls', '3.6.0'):
pytest.skip('mbedtls TLSv1.3 session resume not working before 3.6.0')

7
tests/runtests.pl
View file

@ -574,13 +574,6 @@ sub checksystemfeatures {
$feature{"wolfssl"} = 1;
$feature{"SSLpinning"} = 1;
}
elsif ($libcurl =~ /\sbearssl\b/i) {
$feature{"bearssl"} = 1;
}
elsif ($libcurl =~ /\ssecuretransport\b/i) {
$feature{"sectransp"} = 1;
$feature{"SSLpinning"} = 1;
}
elsif ($libcurl =~ /\s(BoringSSL|AWS-LC)\b/i) {
# OpenSSL compatible API
$feature{"OpenSSL"} = 1;

2
tests/unit/unit1651.c
View file

@ -34,7 +34,7 @@ static void unit_stop(void)
{
}
#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_SECTRANSP)
#if defined(USE_GNUTLS) || defined(USE_SCHANNEL)
/* cert captured from gdb when connecting to curl.se on October 26
2018 */

3
tests/unit/unit1656.c
View file

@ -35,8 +35,7 @@ static void unit_stop(void)
}
#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_SECTRANSP) || \
defined(USE_MBEDTLS)
#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_MBEDTLS)
struct test_spec {
const char *input;

184
tests/unit/unit3205.c
View file

@ -34,8 +34,7 @@ static void unit_stop(void)
{
}
#if defined(USE_SECTRANSP) || defined(USE_MBEDTLS) || \
defined(USE_BEARSSL) || defined(USE_RUSTLS)
#if defined(USE_MBEDTLS) || defined(USE_RUSTLS)
struct test_cs_entry {
uint16_t id;
@ -43,7 +42,7 @@ struct test_cs_entry {
const char *openssl;
};
static const struct test_cs_entry test_cs_list[] = {
#if defined(USE_SECTRANSP) || defined(USE_MBEDTLS) || defined(USE_RUSTLS)
#if defined(USE_MBEDTLS) || defined(USE_RUSTLS)
{ 0x1301, "TLS_AES_128_GCM_SHA256",
NULL },
{ 0x1302, "TLS_AES_256_GCM_SHA384",
@ -67,7 +66,7 @@ static const struct test_cs_entry test_cs_list[] = {
"ECDHE-RSA-CHACHA20-POLY1305" },
{ 0xCCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
"ECDHE-ECDSA-CHACHA20-POLY1305" },
#if defined(USE_SECTRANSP) || defined(USE_MBEDTLS) || defined(USE_BEARSSL)
#if defined(USE_MBEDTLS)
{ 0x002F, "TLS_RSA_WITH_AES_128_CBC_SHA",
"AES128-SHA" },
{ 0x0035, "TLS_RSA_WITH_AES_256_CBC_SHA",
@ -121,7 +120,7 @@ static const struct test_cs_entry test_cs_list[] = {
{ 0xC032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384",
"ECDH-RSA-AES256-GCM-SHA384" },
#endif
#if defined(USE_SECTRANSP) || defined(USE_MBEDTLS)
#if defined(USE_MBEDTLS)
{ 0x0001, "TLS_RSA_WITH_NULL_MD5",
"NULL-MD5" },
{ 0x0002, "TLS_RSA_WITH_NULL_SHA",
@ -209,19 +208,7 @@ static const struct test_cs_entry test_cs_list[] = {
{ 0xCCAB, "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256",
"PSK-CHACHA20-POLY1305" },
#endif
#if defined(USE_SECTRANSP) || defined(USE_BEARSSL)
{ 0x000A, "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
"DES-CBC3-SHA" },
{ 0xC003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA",
"ECDH-ECDSA-DES-CBC3-SHA" },
{ 0xC008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA",
"ECDHE-ECDSA-DES-CBC3-SHA" },
{ 0xC00D, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA",
"ECDH-RSA-DES-CBC3-SHA" },
{ 0xC012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
"ECDHE-RSA-DES-CBC3-SHA" },
#endif
#if defined(USE_MBEDTLS) || defined(USE_BEARSSL)
#if defined(USE_MBEDTLS)
{ 0xC09C, "TLS_RSA_WITH_AES_128_CCM",
"AES128-CCM" },
{ 0xC09D, "TLS_RSA_WITH_AES_256_CCM",
@ -239,147 +226,6 @@ static const struct test_cs_entry test_cs_list[] = {
{ 0xC0AF, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8",
"ECDHE-ECDSA-AES256-CCM8" },
#endif
#if defined(USE_SECTRANSP)
{ 0x0003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5",
"EXP-RC4-MD5" },
{ 0x0004, "TLS_RSA_WITH_RC4_128_MD5",
"RC4-MD5" },
{ 0x0005, "TLS_RSA_WITH_RC4_128_SHA",
"RC4-SHA" },
{ 0x0006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5",
"EXP-RC2-CBC-MD5" },
{ 0x0007, "TLS_RSA_WITH_IDEA_CBC_SHA",
"IDEA-CBC-SHA" },
{ 0x0008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA",
"EXP-DES-CBC-SHA" },
{ 0x0009, "TLS_RSA_WITH_DES_CBC_SHA",
"DES-CBC-SHA" },
{ 0x000B, "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA",
"EXP-DH-DSS-DES-CBC-SHA" },
{ 0x000C, "TLS_DH_DSS_WITH_DES_CBC_SHA",
"DH-DSS-DES-CBC-SHA" },
{ 0x000D, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA",
"DH-DSS-DES-CBC3-SHA" },
{ 0x000E, "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA",
"EXP-DH-RSA-DES-CBC-SHA" },
{ 0x000F, "TLS_DH_RSA_WITH_DES_CBC_SHA",
"DH-RSA-DES-CBC-SHA" },
{ 0x0010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA",
"DH-RSA-DES-CBC3-SHA" },
{ 0x0011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA",
"EXP-DHE-DSS-DES-CBC-SHA" },
{ 0x0012, "TLS_DHE_DSS_WITH_DES_CBC_SHA",
"DHE-DSS-DES-CBC-SHA" },
{ 0x0013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA",
"DHE-DSS-DES-CBC3-SHA" },
{ 0x0014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA",
"EXP-DHE-RSA-DES-CBC-SHA" },
{ 0x0015, "TLS_DHE_RSA_WITH_DES_CBC_SHA",
"DHE-RSA-DES-CBC-SHA" },
{ 0x0016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA",
"DHE-RSA-DES-CBC3-SHA" },
{ 0x0017, "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5",
"EXP-ADH-RC4-MD5" },
{ 0x0018, "TLS_DH_anon_WITH_RC4_128_MD5",
"ADH-RC4-MD5" },
{ 0x0019, "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA",
"EXP-ADH-DES-CBC-SHA" },
{ 0x001A, "TLS_DH_anon_WITH_DES_CBC_SHA",
"ADH-DES-CBC-SHA" },
{ 0x001B, "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA",
"ADH-DES-CBC3-SHA" },
{ 0x0030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA",
"DH-DSS-AES128-SHA" },
{ 0x0031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA",
"DH-RSA-AES128-SHA" },
{ 0x0032, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA",
"DHE-DSS-AES128-SHA" },
{ 0x0034, "TLS_DH_anon_WITH_AES_128_CBC_SHA",
"ADH-AES128-SHA" },
{ 0x0036, "TLS_DH_DSS_WITH_AES_256_CBC_SHA",
"DH-DSS-AES256-SHA" },
{ 0x0037, "TLS_DH_RSA_WITH_AES_256_CBC_SHA",
"DH-RSA-AES256-SHA" },
{ 0x0038, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA",
"DHE-DSS-AES256-SHA" },
{ 0x003A, "TLS_DH_anon_WITH_AES_256_CBC_SHA",
"ADH-AES256-SHA" },
{ 0x003E, "TLS_DH_DSS_WITH_AES_128_CBC_SHA256",
"DH-DSS-AES128-SHA256" },
{ 0x003F, "TLS_DH_RSA_WITH_AES_128_CBC_SHA256",
"DH-RSA-AES128-SHA256" },
{ 0x0040, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256",
"DHE-DSS-AES128-SHA256" },
{ 0x0068, "TLS_DH_DSS_WITH_AES_256_CBC_SHA256",
"DH-DSS-AES256-SHA256" },
{ 0x0069, "TLS_DH_RSA_WITH_AES_256_CBC_SHA256",
"DH-RSA-AES256-SHA256" },
{ 0x006A, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256",
"DHE-DSS-AES256-SHA256" },
{ 0x006C, "TLS_DH_anon_WITH_AES_128_CBC_SHA256",
"ADH-AES128-SHA256" },
{ 0x006D, "TLS_DH_anon_WITH_AES_256_CBC_SHA256",
"ADH-AES256-SHA256" },
{ 0x008A, "TLS_PSK_WITH_RC4_128_SHA",
"PSK-RC4-SHA" },
{ 0x008B, "TLS_PSK_WITH_3DES_EDE_CBC_SHA",
"PSK-3DES-EDE-CBC-SHA" },
{ 0x008E, "TLS_DHE_PSK_WITH_RC4_128_SHA",
"DHE-PSK-RC4-SHA" },
{ 0x008F, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA",
"DHE-PSK-3DES-EDE-CBC-SHA" },
{ 0x0092, "TLS_RSA_PSK_WITH_RC4_128_SHA",
"RSA-PSK-RC4-SHA" },
{ 0x0093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA",
"RSA-PSK-3DES-EDE-CBC-SHA" },
{ 0x00A0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256",
"DH-RSA-AES128-GCM-SHA256" },
{ 0x00A1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384",
"DH-RSA-AES256-GCM-SHA384" },
{ 0x00A2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256",
"DHE-DSS-AES128-GCM-SHA256" },
{ 0x00A3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384",
"DHE-DSS-AES256-GCM-SHA384" },
{ 0x00A4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256",
"DH-DSS-AES128-GCM-SHA256" },
{ 0x00A5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384",
"DH-DSS-AES256-GCM-SHA384" },
{ 0x00A6, "TLS_DH_anon_WITH_AES_128_GCM_SHA256",
"ADH-AES128-GCM-SHA256" },
{ 0x00A7, "TLS_DH_anon_WITH_AES_256_GCM_SHA384",
"ADH-AES256-GCM-SHA384" },
{ 0xC002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA",
"ECDH-ECDSA-RC4-SHA" },
{ 0xC007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",
"ECDHE-ECDSA-RC4-SHA" },
{ 0xC00C, "TLS_ECDH_RSA_WITH_RC4_128_SHA",
"ECDH-RSA-RC4-SHA" },
{ 0xC011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA",
"ECDHE-RSA-RC4-SHA" },
{ 0xC015, "TLS_ECDH_anon_WITH_NULL_SHA",
"AECDH-NULL-SHA" },
{ 0xC016, "TLS_ECDH_anon_WITH_RC4_128_SHA",
"AECDH-RC4-SHA" },
{ 0xC017, "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA",
"AECDH-DES-CBC3-SHA" },
{ 0xC018, "TLS_ECDH_anon_WITH_AES_128_CBC_SHA",
"AECDH-AES128-SHA" },
{ 0xC019, "TLS_ECDH_anon_WITH_AES_256_CBC_SHA",
"AECDH-AES256-SHA" },
/* Backward compatible aliases (EDH vs DHE) */
{ 0x0011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA",
"EXP-EDH-DSS-DES-CBC-SHA" },
{ 0x0012, "TLS_DHE_DSS_WITH_DES_CBC_SHA",
"EDH-DSS-DES-CBC-SHA" },
{ 0x0013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA",
"EDH-DSS-DES-CBC3-SHA" },
{ 0x0014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA",
"EXP-EDH-RSA-DES-CBC-SHA" },
{ 0x0015, "TLS_DHE_RSA_WITH_DES_CBC_SHA",
"EDH-RSA-DES-CBC-SHA" },
{ 0x0016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA",
"EDH-RSA-DES-CBC3-SHA" },
#endif
#if defined(USE_MBEDTLS)
/* entries marked ns are non-"standard", they are not in OpenSSL */
{ 0x0041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA",
@ -608,7 +454,7 @@ struct test_str_entry {
const char *str;
};
static const struct test_str_entry test_str_list[] = {
#if defined(USE_SECTRANSP) || defined(USE_MBEDTLS) || defined(USE_RUSTLS)
#if defined(USE_MBEDTLS) || defined(USE_RUSTLS)
{ 0x1301, "TLS_AES_128_GCM_SHA256"},
{ 0x1302, "TLS_AES_256_GCM_SHA384"},
{ 0x1303, "TLS_CHACHA20_POLY1305_SHA256"},
@ -623,7 +469,7 @@ static const struct test_str_entry test_str_list[] = {
{ 0xC030, "ECDHE-RSA-AES256-GCM-SHA384"},
{ 0xCCA9, "ECDHE-ECDSA-CHACHA20-POLY1305"},
{ 0xCCA8, "ECDHE-RSA-CHACHA20-POLY1305"},
#if defined(USE_SECTRANSP) || defined(USE_MBEDTLS)
#if defined(USE_MBEDTLS)
{ 0x009E, "DHE-RSA-AES128-GCM-SHA256"},
{ 0x009F, "DHE-RSA-AES256-GCM-SHA384"},
#else
@ -635,7 +481,7 @@ static const struct test_str_entry test_str_list[] = {
#else
{ 0x0000, "DHE-RSA-CHACHA20-POLY1305"},
#endif
#if defined(USE_SECTRANSP) || defined(USE_MBEDTLS) || defined(USE_BEARSSL)
#if defined(USE_MBEDTLS)
{ 0xC023, "ECDHE-ECDSA-AES128-SHA256" },
{ 0xC027, "ECDHE-RSA-AES128-SHA256" },
{ 0xC009, "ECDHE-ECDSA-AES128-SHA" },
@ -654,14 +500,14 @@ static const struct test_str_entry test_str_list[] = {
{ 0x0000, "ECDHE-ECDSA-AES256-SHA" },
{ 0x0000, "ECDHE-RSA-AES256-SHA" },
#endif
#if defined(USE_SECTRANSP) || defined(USE_MBEDTLS)
#if defined(USE_MBEDTLS)
{ 0x0067, "DHE-RSA-AES128-SHA256" },
{ 0x006B, "DHE-RSA-AES256-SHA256" },
#else
{ 0x0000, "DHE-RSA-AES128-SHA256" },
{ 0x0000, "DHE-RSA-AES256-SHA256" },
#endif
#if defined(USE_SECTRANSP) || defined(USE_MBEDTLS) || defined(USE_BEARSSL)
#if defined(USE_MBEDTLS)
{ 0x009C, "AES128-GCM-SHA256" },
{ 0x009D, "AES256-GCM-SHA384" },
{ 0x003C, "AES128-SHA256" },
@ -676,11 +522,7 @@ static const struct test_str_entry test_str_list[] = {
{ 0x0000, "AES128-SHA" },
{ 0x0000, "AES256-SHA" },
#endif
#if defined(USE_SECTRANSP) || defined(USE_BEARSSL)
{ 0x000A, "DES-CBC3-SHA" },
#else
{ 0x0000, "DES-CBC3-SHA" },
#endif
{ 0x0000, "GIBBERISH" },
{ 0x0000, "" },
};
@ -785,11 +627,9 @@ UNITTEST_START
}
UNITTEST_STOP
#else /* defined(USE_SECTRANSP) || defined(USE_MBEDTLS) || \
defined(USE_BEARSSL) */
#else /* defined(USE_MBEDTLS) */
UNITTEST_START
UNITTEST_STOP
#endif /* defined(USE_SECTRANSP) || defined(USE_MBEDTLS) || \
defined(USE_BEARSSL) || defined(USE_RUSTLS) */
#endif /* defined(USE_MBEDTLS) || defined(USE_RUSTLS) */