[Info-vax] OpenSSL CSWS-2.2-1

[Craig A. Berry]

On 4/6/19 8:58 PM, Stephen Hoffman wrote:
> So we have CSWS, which everybody obviously knows is a web 
> server.

Not just a web server, but a secure web server from a company named
Compaq that never knew anything about servers or security.

> This particular mess is also why I've commented around the lack of an 
> API for OpenVMS that masks these differences and that makes creating a 
> secure network connection rather less of a project than is currently 
> involved.  I've pointed to Secure Transport and similar approaches as 
> one of various examples from other platforms that have sought to reduce 
> or to isolate SSL-level differences from the application developers.
> 
> Alternatives to OpenSSL include NaCl and libtls, among others.

Some VMS-friendly wrapper functions might be nice.  But as far as the
underlying crypto, it would be unwise for VSI to roll any of that on
their own.