Tcl package for the TLS protocol is deprecated

This announcement affects only users of the TclTLS package. TSC and CCS5 installers do not include this package and the OpenSSL library anymore due to the following.

TclTLS is 3rd-party open source software that has been long abandoned. It doesn’t work with current releases of OpenSSL 3.x. Moreover, there’s a 6 years old bug that the package can’t verify the certificate subject name (X509v3 Subject Alternative Name) against a server’s hostname. Therefore, it is impossible to verify the server’s authenticity, and it defies the whole point of using TLS.
Given that over recent years our customers have placed increased emphasis on cybersecurity, we are making effort in reducing potential attack vectors in CCS5 and issues in security audits. One of the decisions that we had to make was to exclude TclTLS and OpenSSL from our deliveries. CCS5 doesn’t require TLS for its own functioning. And if users need OpenSSL, they take responsibility for installing OpenSSL on their platform and keeping it up to date.

If you really need to connect to external systems using TLS in Tcl/TOPE on Windows, you have 2 options that are much better than TclTLS both from security PoV and long-term maintenance:

1. If you need to perform an HTTPS GET request, you can use the utope::ingest function, documented in CCS/TSC UM vol.2. It is based on Qt implementation, and Qt is fundamental to our system, so we do our best to keep it up to date.
2. In all other cases you can use the twapi package that can wrap any Tcl channel with TLS. It is a well-supported package, and CCS5 itself relies on it for various functions.

In both cases the low-level TLS implementation is based not on OpenSSL but on the Windows Schannel technology, which provides at least 2 advantages over OpenSSL:

• Security updates are part of the standard Windows update mechanism, freeing users from the need to update OpenSSL themselves.
• Schannel is integrated with Windows Root CA (certificate authority) storage, while OpenSSL requires extra configuration to make it trust corporate Root CAs.

This blog post provides more details on the state of TLS on Windows and examples of using twapi.

If you need TLS on Linux, your options depend on a use case:

• the aforementioned utope::ingest, which is based on Qt/OpenSSL that is native to the Linux ecosystem
• access to a low-level TCP socket directly in Tcl is possible with the tcl-s2n package available from Github
• if all you need is HTTPS requests, you can simply call "exec curl" or "exec wget" from Tcl
• TclTLS package is still available from Linux repositories (example). However, it is based on OpenSSL 1.1.1 that is past EoL with all corresponding consequences for cybersecurity.

Another language-independent option is to use a TLS proxy like stunnel that works on both Linux and Windows.

.

.