Over the past week a denial-of-service (DoS) report against OpenSSL, named “HollowByte” by the Okta Red Team who reported it, has received a good deal of press attention. A number of the articles ask reasonable questions about how we assessed the report and why we handled the fix the way we did. This post sets out our analysis and the reasoning behind our decisions. We are grateful to the Okta Red…
The OpenSSL Library has adopted an AI policy. To summarize: Anyone who uses AI to provide a non-trivial portion of their contributions to the OpenSSL Library must: Sign an updated Contributor License Agreement (CLA) that includes the AI clauses. Declare any AI use in the commit message of each contribution. This is done via an Assisted-by trailer as explained in the policy. People who do not use A…
At ICMC26, Tim Hudson announced a change to the OpenSSL Library release schedule for future releases. Last year we committed to making long term stable (LTS) releases every two years. Following the release of 4.0, the first major release since 2018, we now commit to a major release every two years. So the next LTS will be 4.2 in April 2027 and then we’ll have a major release, 5.0, in October 2027.…
The final release of OpenSSL 4.0 is now live. We would like to thank all those who contributed to the OpenSSL 4.0 release, without whom the OpenSSL Library would not be possible.
Previous posts about the upcoming OpenSSL 4.0 release: removing ENGINE code removing deprecated functions for creating or modifying custom METHODS no longer registering a function via atexit function adding ECH support removing SSLv3 and SSLv2 Client Hello Summary The ASN1_STRING structure can no longer be accessed directly. Instead, accessor functions must be used. While these accessor functions…
Previous posts about the upcoming OpenSSL 4.0 release: removing ENGINE code removing deprecated functions for creating or modifying custom METHODS no longer registering a function via atexit function adding ECH support Summary Secure Sockets Layer version 3.0 (SSLv3) was deprecated in RFC 7568. SSLv3 was disabled at build-time in OpenSSL 1.0.2h by default. As of OpenSSL 4.0, SSLv3 support has been…
Release Announcement for OpenSSL Library 3.6.2, 3.5.6, 3.4.5, 3.3.7, 3.0.20, 1.1.1zg and 1.0.2zp The OpenSSL Project team announces the release of new versions of our open-source toolkit for SSL/TLS.
The OpenSSL Project is pleased to announce that OpenSSL 4.0 Beta1 pre-release is available, adding significant functionality to the OpenSSL Library.
The expiration date of the OpenSSL release signing key with fingerprint BA5473A2B0587B07FB27CF2D216094DFD0CB81EF has been extended from 08 Apr 2026 to 14 Jun 2026. Only the key expiration date has changed. The signing key itself remains the same. The updated public key is available at: https://keys.openpgp.org/search?q=BA5473A2B0587B07FB27CF2D216094DFD0CB81EF
Previous posts about the upcoming OpenSSL 4.0 release: removing ENGINE code removing deprecated functions for creating or modifying custom METHODS no longer registering a function via atexit function Summary The OpenSSL Library now supports Encrypted Client Hello (ECH) specified in RFC 9849, which was published this month. Applications that implement this standard will be able to encrypt sensitive…
Previous posts about features removed from OpenSSL 4.0: ENGINE code deprecated functions for creating or modifying custom METHODS Summary The OPENSSL_cleanup() function is no longer registered to be called upon the termination of the process. This means the OpenSSL Library does not automatically free resources so the operating system reclaims them when an application exits. For most users, this wi…
The OpenSSL Project is announcing the upcoming release of OpenSSL 4.0 Alpha, scheduled for March 10, 2026. As a result, the repository will be frozen before the release on February 24, 2026.
Following on from the removal of ENGINE code, deprecated functions for creating or modifying custom METHODS will be removed from OpenSSL 4.0. Summary For a complete list of deprecated functions removed in OpenSSL 4.0, please see the ossl-removed-api documentation. They are divided into the following pull requests: Custom ciphers methods (EVP_CIPHER_meth_*) were removed in PR #29299. Custom message…
Release Announcement for OpenSSL Library 3.6.1, 3.5 5, 3.4.4, 3.3.6, 3.0.19, 1.1.1ze and 1.0.2zn The OpenSSL Project team announces the release of new versions of our open-source toolkit for SSL/TLS.
OpenSSL 4.0, to be released in April 2026, is the first major release since 3.0 which replaced the ENGINE interface with Providers. Removing ENGINEs is a primary goal of this major release and this post describes the change agreed to by both the OpenSSL Corporation and OpenSSL Foundation. Summary All symbols defined in openssl/engine.h have been removed from the shared library in OpenSSL 4.0. Appl…
The voting from the Foundation BAC has been extended through December 21. If you want to participate in the future of the OpenSSL Foundation, please join the communities site and vote for your representative. The currently running elections are: Academics Individuals Distributions Large Business Small Business For details about how the election works, please consult the Foundation Election Guide.
The OpenSSL Library would like to modernise and streamline development processes, especially to ensure effective code review and make the project easier for contributors to contribute to. As part of this effort, we will be making some changes to our coding style guidelines and adopting clang-format using the WebKit C coding style as enforced by clang-format. We will transition to using clang-forma…
OpenSSL 3.2 series has reached its End of Life (EOL). As such it will no longer receive publicly available security fixes.
September has come and gone, so it’s past time to recognize new contributors to the OpenSSL Library: author date PR xiaoloudongfeng 2025-09-02 fix length of digestinfo_sm3_der Pkeane22 2025-09-07 Fixed typo LuiginoC 2025-09-10 crypto/evp/bio_ok.c:Integer Overflow in BIO_f_reliable record parser leads to Out-of-Bounds Read ritesh006 2025-09-11 doc: clarify SSL_SESSION_get0_hostname notes jedenastka…
The OpenSSL Corporation and the OpenSSL Foundation celebrate the success of the inaugural OpenSSL Conference, held in Prague, October 7-9. This was the first time in the history of the OpenSSL Project that the full community met in person. Developers, legal experts, and users from academics, committers, distributions, individuals, large businesses, and small businesses came together to discuss pro…
Believe it or not, it’s time to start the election process for the 2026 Foundation Business Advisory Committee (FBAC). Advisory committees play a critical role in the governance of the OpenSSL Foundation. This committee focuses on the strategic direction of the OpenSSL Foundation and our mission. Each of the six communities (Academics, Committers, Distributions, Individuals, Large Businesses and S…
Lightship Security, an Applus+ Laboratories company and accredited cryptographic security test laboratory, and the OpenSSL Corporation, the co-maintainer of the OpenSSL Library, announce the submission of OpenSSL version 3.5.4 to the Cryptographic Module Validation Program (CMVP) for FIPS 140-3 validation. This submission confirms that the code is complete and that all included algorithms have suc…
The final release of OpenSSL 3.6 is now live. We would like to thank all those who contributed to the OpenSSL 3.6 release, without whom the OpenSSL Library would not be possible.
Release Announcement for OpenSSL Library 3.5.4, 3.4.3, 3.3.5, 3.2.6, 3.0.18, 1.1.1zd and 1.0.2zm The OpenSSL Project team announces the release of new versions of our open-source toolkit for SSL/TLS.
Among the 91 PRs approved in August, 6 were from people who hadn’t contributed to OpenSSL’s code base until now. author date PR zl523856 2025-08-03 [RISC-V] Further optimization for AES-128-CBC decryption performance ChillerDragon 2025-08-04 Improve english in endian comment ritoban23 2025-08-13 Fix potential null pointer dereference in pkey_dh_derive vkryl 2025-08-15 Android: Enable 16 KB ELF ali…
The OpenSSL Project is pleased to announce that OpenSSL 3.6 Beta1 pre-release is available, adding significant functionality to the OpenSSL Library.
Release Announcement for OpenSSL Library 3.5.3 The OpenSSL Project team announces the release of new versions of our open-source toolkit for SSL/TLS.
The OpenSSL Project is pleased to announce that OpenSSL 3.6 Alpha1 pre-release is released and adding significant new functionality to OpenSSL Library.
In July, 58 pull requests were approved for merge into the OpenSSL Library code base. There were also four people who contributed code for the first time: yzpgryx provided a fix to support the SM2 PEM format with matching tests. caolanm designated an unchanging structure to be constant. igus68 found a good first issue and fixed it. Before this fix, the OpenSSL cryptographic library would accept a…
Early Bird registration is now open for the inaugural OpenSSL Conference, taking place from October 7 to 9, 2025, in Prague, Czech Republic. Take advantage of exclusive Early Bird rates and secure your spot now! Join the global community of cryptographers, open-source innovators, security experts, and thought leaders who shape the future of secure communications. The OpenSSL Conference promises to…