I did not make any elaborate checks for GnuTLS and wolfSSL as I figure they are much less likely to be a problem for users since they support QUIC "from scratch".

Nice. One problem remains. vquic-tls.c should guard against !USE_MSH3, because that is a QUIC built that "works" with a plain OpenSSL.

Oh right, that complicates matters a little...

because that is a QUIC built that "works" with a plain OpenSSL.

From Msh3's About: Minimal HTTP/3 library on top of MsQuic.
So not necessarily plain OpenSSL. Ref: https://github.com/microsoft/msquic/blob/main/docs/Platforms.md.

They write like this about Linux builds:

Important This configuration relies on a fork of OpenSSL for QUIC/TLS support. It is still currently unknown as to when mainline will support QUIC

It seems they only support vanilla OpenSSL on Windows?

So what about USE_MSH3 on Windows?
Now I need to add CSOURCES := $(filter-out vquic/vquic-tls.c, $(CSOURCES)) to my tweaked Makefile
since the warning/error is still the same:

vquic/vquic-tls.c(219,3): warning C4013: 'SSL_set_quic_use_legacy_codepoint' undefined; assuming extern returning int
  SSL_set_quic_use_legacy_codepoint(ctx->ssl, 0);
  ^

That needs a different take than this PR, yes. It probably needs adjustments in the code.

We should probably have CI jobs doing HTTTP/3 on Windows too...

Or should it say:

--- a/lib/vquic/vquic-tls.c 2024-01-11 11:17:26
+++ b/lib/vquic/vquic-tls.c 2024-01-12 10:26:47
@@ -24,7 +24,7 @@

 #include "curl_setup.h"

-#if defined(ENABLE_QUIC) && \
+#if defined(ENABLE_QUIC) && defined(USE_NGTCP2) && defined(USE_NGHTTP3) \
   (defined(USE_OPENSSL) || defined(USE_GNUTLS) || defined(USE_WOLFSSL))

 #ifdef USE_OPENSSL

Isn't it used for quiche too?

So maybe?

#if defined(ENABLE_QUIC) && !defined(USE_MSH3) && \
  (defined(USE_OPENSSL) || defined(USE_GNUTLS) || defined(USE_WOLFSSL))

or wait, isn't this still needed for msh3 on linux?

We use this code only for ngtcp2 and quiche now. So

#if (defined(USE_NGTCP2) || defined(USE_QUICHE)) && \
  (defined(USE_OPENSSL) || defined(USE_GNUTLS) || defined(USE_WOLFSSL))

should do it?

or just

#if (defined(USE_NGTCP2) || defined(USE_QUICHE))

right, the latter might be enough

If we later need it for msh3 on linux, I figure we could set a define for each specific backend that needs the init instead, like #define VQUIC_TLS_INIT 1 and only check for that.