Support (smaller) SSL implementations than OpenSSL

This is something I'll consider for version 1.3.

Going through the list of TLS implementations there is only one that matches both our requirements.

CyaSSL, MatrixSSL and PolarSSL are GPL/commercial so are not suitable.
GnuTLS is LGPL, but is of a similar size to openssl.
NSS is huge, doesn't seem to have many examples and is poorly documented (at least openssl has wide usage even if the docs are poor)

axTLS is BSD licensed and is small. It doesn't support TLS-PSK which is a shame, but that is a sacrifice that can be made.

Why are GPL/commercial implementations not suitable?
I suppose someone might want to buy a commercial license to use with Mosquitto in their own product.

What I'm getting at is that a SSL abstraction layer would be useful, like cURL has for example: http://curl.haxx.se/docs/faq.html#Does_curl_work_build_with_other

As for PolarSSL, their website mention a FOSS license exception, which mentions the BSD license.
That should make it compatible with Mosquitto, right?

> Why are GPL/commercial implementations not suitable?

A GPL licensed library would require me to change the mosquitto
license to GPL and I'm not paying for a commercial licence.

> I suppose someone might want to buy a commercial license to use with Mosquitto in their own product.

This is true, but that is up to them.

> What I'm getting at is that a SSL abstraction layer would be useful,
> like cURL has for example:

I'm not going to disagree, but I have only got so much time. I would
prefer to focus on things that are more important for the moment.

> As for PolarSSL, their website mention a FOSS license exception, which mentions the BSD license.
> That should make it compatible with Mosquitto, right?

That is correct, I hadn't seen that - thanks!

>> I suppose someone might want to buy a commercial license to use with Mosquitto in their own product.
> This is true, but that is up to them.

Indeed, I didn't imply that YOU would buy a commercial license. But that someone else could do that, justifying the usefulness of an abstraction layer.

> I'm not going to disagree, but I have only got so much time. I would prefer to focus on things that are more important for the moment.

Sure, I was only suggesting -- I'm not requesting anything.
By the way, how could I help in the project? In general, how can people support your project?
What about some kind of crowdfunding (bounties, etc) to get new features implemented?

Hi there,

I'm migrating bugs to Eclipse, the new url for this bug is:

https://bugs.eclipse.org/bugs/show_bug.cgi?id=452923