#1152488 openssl: please include a configuration drop-in directory

Package:
openssl
Source:
openssl
Description:
Secure Sockets Layer toolkit - cryptographic utility
Submitter:
Daniel Ramos
Date:
2026-10-29 21:37:02 UTC
Severity:
normal
#1152488#5
Date:
2026-10-29 21:35:06 UTC
From:
To:
Hello.
Debian's /etc/ssl/openssl.cnf includes no directory, so a package that ships an OpenSSL provider (openssl-provider-fips, pkcs11-provider, tpm2-openssl, openssl-provider-qat) cannot activate it system-wide without the administrator editing the conffile.
Would you consider ending the file with `.include /etc/ssl/openssl.cnf.d` and shipping that directory empty?
In Sparky Stereo OS, a SparkyLinux edition, we ship an Ed521 verification provider for ICP-Brasil's root v7, and today we divert /usr/lib/ssl/openssl.cnf to reach it, which we would rather not do.
A snippet must also activate the default provider, because activating any provider turns the implicit default off; we can propose the wording and tests.
Prepared with AI assistance (Claude), reviewed by me.
Daniel Campos Ramos