configure: make the TLS library choice(s) explicit

configure no longer tries to find a TLS library by default, but all
libraries are now equal: the user needs to explicitly ask what TLS
library or libraries to use.

If no TLS library is selected, configure will error out unless
--without-ssl is explicitly used to request a built without TLS (as that
is very rare these days).

Removes: --with-winssl, --with-darwinssl and all --without-* options for
TLS libraries.

Closes #6897

docs/INSTALL.md

@@ -30,11 +30,13 @@ proceed.
 A normal Unix installation is made in three or four steps (after you've
 unpacked the source archive):
 
-    ./configure
+    ./configure --with-openssl [--with-gnutls --with-wolfssl]
     make
     make test (optional)
     make install
 
+(Adjust the configure line accordingly to use the TLS library you want.)
+
 You probably need to be root when doing the last command.
 
 Get a full listing of all available configure options by invoking it like:
@@ -73,7 +75,7 @@ Without pkg-config installed, use this:
 If you insist on forcing a build without SSL support, even though you may
 have OpenSSL installed in your system, you can run configure like this:
 
-    ./configure --without-openssl
+    ./configure --without-ssl
 
 If you have OpenSSL installed, but with the libraries in one place and the
 header files somewhere else, you have to set the `LDFLAGS` and `CPPFLAGS`
@@ -109,17 +111,19 @@ want to alter it, you can select how to deal with each individual library.
 
 ## Select TLS backend
 
-The default OpenSSL configure check will also detect and use BoringSSL or
-libressl.
+These options are provided to select TLS backend to use.
 
- - GnuTLS: `--without-openssl --with-gnutls`.
- - wolfSSL: `--without-openssl --with-wolfssl`
- - NSS: `--without-openssl --with-nss`
- - mbedTLS: `--without-openssl --with-mbedtls`
- - schannel: `--without-openssl --with-schannel`
- - secure transport: `--without-openssl --with-secure-transport`
- - MesaLink: `--without-openssl --with-mesalink`
- - BearSSL: `--without-openssl --with-bearssl`
+ - AmiSSL: `--with-amissl`
+ - BearSSL: `--with-bearssl`
+ - GnuTLS: `--with-gnutls`.
+ - mbedTLS: `--with-mbedtls`
+ - MesaLink: `--with-mesalink`
+ - NSS: `--with-nss`
+ - OpenSSL: `--with-openssl` (also for BoringSSL and libressl)
+ - rustls: `--with-rustls`
+ - schannel: `--with-schannel`
+ - secure transport: `--with-secure-transport`
+ - wolfSSL: `--with-wolfssl`
 
 # Windows
 

docs/TODO

@@ -112,7 +112,6 @@
  13.4 Cache/share OpenSSL contexts
  13.5 Export session ids
  13.6 Provide callback for cert verification
- 13.7 improve configure --with-openssl
  13.8 Support DANE
  13.9 TLS record padding
  13.10 Support Authority Information Access certificate extension (AIA)
@@ -768,13 +767,6 @@
  certificate, but this doesn't seem to be exposed in the libcurl APIs. Could
  it be? There's so much that could be done if it were!
 
-13.7 improve configure --with-openssl
-
- Consider making the configure script not guess which TLS library to use (as
- it makes it harder to purposely select another library than the default).
- Maybe require specific TLS library option(s) or an explicit no-TLS-at-all
- option.
-
 13.8 Support DANE
 
  DNS-Based Authentication of Named Entities (DANE) is a way to provide SSL