@@ -111,7 +111,7 @@ HAProxy requires a working GCC or Clang toolchain and GNU make :
111111 may want to retry with "gmake" which is the name commonly used for GNU make
112112 on BSD systems.
113113
114- - GCC >= 4.7 (up to 14 tested). Older versions are no longer supported due to
114+ - GCC >= 4.7 (up to 15 tested). Older versions are no longer supported due to
115115 the latest mt_list update which only uses c11-like atomics. Newer versions
116116 may sometimes break due to compiler regressions or behaviour changes. The
117117 version shipped with your operating system is very likely to work with no
@@ -237,7 +237,7 @@ to forcefully enable it using "USE_LIBCRYPT=1".
237237-----------------
238238For SSL/TLS, it is necessary to use a cryptography library. HAProxy currently
239239supports the OpenSSL library, and is known to build and work with branches
240- 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, and 3.0 to 3.5 . It is recommended to use
240+ 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, and 3.0 to 3.6 . It is recommended to use
241241at least OpenSSL 1.1.1 to have support for all SSL keywords and configuration
242242in HAProxy. OpenSSL follows a long-term support cycle similar to HAProxy's,
243243and each of the branches above receives its own fixes, without forcing you to
@@ -259,11 +259,15 @@ reported to work as well. While there are some efforts from the community to
259259ensure they work well, OpenSSL remains the primary target and this means that
260260in case of conflicting choices, OpenSSL support will be favored over other
261261options. Note that QUIC is not fully supported when haproxy is built with
262- OpenSSL < 3.5 version. In this case, QUICTLS is the preferred alternative.
263- As of writing this, the QuicTLS project follows OpenSSL very closely and provides
264- update simultaneously, but being a volunteer-driven project, its long-term future
265- does not look certain enough to convince operating systems to package it, so it
266- needs to be build locally. See the section about QUIC in this document.
262+ OpenSSL < 3.5.2 version. In this case, QUICTLS or AWS-LC are the preferred
263+ alternatives. As of writing this, the QuicTLS project follows OpenSSL very
264+ closely and provides update simultaneously, but being a volunteer-driven
265+ project, its long-term future does not look certain enough to convince
266+ operating systems to package it, so it needs to be build locally. Recent
267+ versions of AWS-LC (>= 1.22 and the FIPS branches) are pretty complete and
268+ generally more performant than other OpenSSL derivatives, but may behave
269+ slightly differently, particularly when dealing with outdated setups. See
270+ the section about QUIC in this document.
267271
268272A fifth option is wolfSSL (https://github.com/wolfSSL/wolfssl). It is the only
269273supported alternative stack not based on OpenSSL, yet which implements almost
0 commit comments