ed25519 server certificates problems with libressl

[bagder]

Someone tripped over the fact that server signatures signed with ED25519 does not work with curl+libressl (nor with schannel), but does with curl using some of the other backends (for example OpenSSL).

The request for ed25519 server certificate support in libressl remains open: libressl/portable#821

[vszakats]

This should probably become a list at one point, other missing features:

• LibreSSL (as of 4.1.0) does not support TLSv1.3 session tickets
  TLS 1.3 server side support & TLS 1.3 resumption support? libressl/portable#719
  SSL data will not export curl#18031 (comment)
• SSL_set0_wbio(): libressl 3.7.x doesn't support SSL_set0_wbio() libressl/portable#838
• ECH: Support ECH/ESNI libressl/portable#546
• SSLKEYLOGFILE:
  SSLKEYLOGFILE not working with curl-for-win build curl#13672
  https://marc.info/?l=libressl&m=158908819814107
  https://superuser.com/questions/1871314/curl-for-windows-sslkeylog-file-always-empty-when-running-from-powershell

[bagder]

• SSLKEYLOGFILE support too, right?

[vszakats]

Correct, added it to the list. It may have been a choice for security IIRC.

[bagder]

Right, but for us the reason for the non-support is of course less interesting.

We should probably put this list somewhere that people can find.

[vszakats]

Almost forgot, that I mainain a list of caveats for each dependency, here it is for LibreSSL:

curl-for-win/libressl.sh

Lines 6 to 26 in 9661374

	# Caveats (as of 4.1.0):
	# - CET not enabled in mingw-w64 x64 ASM functions.
	# https://github.com/libressl/portable/pull/1032
	# - ASM support only for x64.
	# - Not possible to hide most ASM symbols from shared lib exports in Linux, macOS.
	# https://github.com/libressl/portable/issues/957
	# Local patch exists for this, or ASM can be disabled.
	# - Still loads config from hardcoded prefix.
	# - Missing `SSL_set0_wbio()` function.
	# https://github.com/libressl/portable/issues/838
	# - No obvious way to selectively disable obsolete protocols/APIs/features.
	# - server signatures signed with ED25519 do not work
	# https://github.com/curl/curl-for-win/discussions/78 https://github.com/libressl/portable/issues/821
	# - ECH support: https://github.com/libressl/portable/issues/546
	# - No support for TLSv1.3 session tickets.
	# https://github.com/libressl/portable/issues/719
	# https://github.com/curl/curl/issues/18031#issuecomment-3144406973
	# - No `SSLKEYLOGFILE` support.
	# https://github.com/curl/curl/issues/13672
	# https://marc.info/?l=libressl&m=158908819814107
	# https://superuser.com/questions/1871314/curl-for-windows-sslkeylog-file-always-empty-when-running-from-powershell

Not overly visible and not "README" quality though.