O
OpenSSL 3.0 End of Life
The OpenSSL 3.0 series has reached its End of Life (EOL). As such it will no longer receive publicly available security fixes.
O
The OpenSSL Library supports DTLS 1.3
OpenSSL 4.1, which will be released in October 2026, adds the Datagram Transport Layer Security (DTLS) protocol version 1.3. Summary According to the DTLS 1.3 standard: DTLS is deliberately designed to be as similar to TLS as possible, both to minimize new security invention and to maximize the amount of code and infrastructure reuse. Therefore DTLS 1.3 offers many of the same benefits of TLS 1.3…
O
OpenSSL 4.1 Alpha Release Announcement
The OpenSSL Project is pleased to announce that OpenSSL 4.1 Alpha1 pre-release is available, which adds significant new functionality to the OpenSSL Library.
O
Foundation Advisory Committee nominations and election (2026)
The 2026 OpenSSL Foundation Advisory Committee nomination period has started! The Foundation is looking for people who want to help guild the future of internet security and data privacy. Whether you are more comfortable on LinkedIn or GitHub, your advice matters. If you haven’t already, join a community. This is required in order to nominate someone or to vote in the election. It also opens the d…
O
On the "HollowByte" denial-of-service report
Over the past week a denial-of-service (DoS) report against OpenSSL, named “HollowByte” by the Okta Red Team who reported it, has received a good deal of press attention. A number of the articles ask reasonable questions about how we assessed the report and why we handled the fix the way we did. This post sets out our analysis and the reasoning behind our decisions. We are grateful to the Okta Red…
O
The OpenSSL Library AI Policy
The OpenSSL Library has adopted an AI policy. To summarize: Anyone who uses AI to provide a non-trivial portion of their contributions to the OpenSSL Library must: Sign an updated Contributor License Agreement (CLA) that includes the AI clauses. Declare any AI use in the commit message of each contribution. This is done via an Assisted-by trailer as explained in the policy. People who do not use A…
O
Future release schedule
At ICMC26, Tim Hudson announced a change to the OpenSSL Library release schedule for future releases. Last year we committed to making long term stable (LTS) releases every two years. Following the release of 4.0, the first major release since 2018, we now commit to a major release every two years. So the next LTS will be 4.2 in April 2027 and then we’ll have a major release, 5.0, in October 2027.…
O
OpenSSL 4.0 Final Release - Live
The final release of OpenSSL 4.0 is now live. We would like to thank all those who contributed to the OpenSSL 4.0 release, without whom the OpenSSL Library would not be possible.
O
ASN1_STRING type is now opaque
Previous posts about the upcoming OpenSSL 4.0 release: removing ENGINE code removing deprecated functions for creating or modifying custom METHODS no longer registering a function via atexit function adding ECH support removing SSLv3 and SSLv2 Client Hello Summary The ASN1_STRING structure can no longer be accessed directly. Instead, accessor functions must be used. While these accessor functions…
O
The OpenSSL Library no longer includes SSLv3
Previous posts about the upcoming OpenSSL 4.0 release: removing ENGINE code removing deprecated functions for creating or modifying custom METHODS no longer registering a function via atexit function adding ECH support Summary Secure Sockets Layer version 3.0 (SSLv3) was deprecated in RFC 7568. SSLv3 was disabled at build-time in OpenSSL 1.0.2h by default. As of OpenSSL 4.0, SSLv3 support has been…
O
OpenSSL Release Announcement for 3.6.2, 3.5.6, 3.4.5, 3.3.7, 3.0.20, 1.1.1zg and 1.0.2zp
Release Announcement for OpenSSL Library 3.6.2, 3.5.6, 3.4.5, 3.3.7, 3.0.20, 1.1.1zg and 1.0.2zp The OpenSSL Project team announces the release of new versions of our open-source toolkit for SSL/TLS.
O
OpenSSL 4.0 Beta Release Announcement
The OpenSSL Project is pleased to announce that OpenSSL 4.0 Beta1 pre-release is available, adding significant functionality to the OpenSSL Library.
O
OpenSSL release signing key expiration extended
The expiration date of the OpenSSL release signing key with fingerprint BA5473A2B0587B07FB27CF2D216094DFD0CB81EF has been extended from 08 Apr 2026 to 14 Jun 2026. Only the key expiration date has changed. The signing key itself remains the same. The updated public key is available at: https://keys.openpgp.org/search?q=BA5473A2B0587B07FB27CF2D216094DFD0CB81EF
O
The OpenSSL Library now supports Encrypted Client Hello (ECH)
Previous posts about the upcoming OpenSSL 4.0 release: removing ENGINE code removing deprecated functions for creating or modifying custom METHODS no longer registering a function via atexit function Summary The OpenSSL Library now supports Encrypted Client Hello (ECH) specified in RFC 9849, which was published this month. Applications that implement this standard will be able to encrypt sensitive…
O
The OpenSSL Library no longer registers an atexit function
Previous posts about features removed from OpenSSL 4.0: ENGINE code deprecated functions for creating or modifying custom METHODS Summary The OPENSSL_cleanup() function is no longer registered to be called upon the termination of the process. This means the OpenSSL Library does not automatically free resources so the operating system reclaims them when an application exits. For most users, this wi…
O
OpenSSL 4.0 Alpha Repository Freeze Approaching
The OpenSSL Project is announcing the upcoming release of OpenSSL 4.0 Alpha, scheduled for March 10, 2026. As a result, the repository will be frozen before the release on February 24, 2026.
O
Custom method functions removed from the OpenSSL Library
Following on from the removal of ENGINE code, deprecated functions for creating or modifying custom METHODS will be removed from OpenSSL 4.0. Summary For a complete list of deprecated functions removed in OpenSSL 4.0, please see the ossl-removed-api documentation. They are divided into the following pull requests: Custom ciphers methods (EVP_CIPHER_meth_*) were removed in PR #29299. Custom message…
O
OpenSSL Release Announcement for 3.6.1, 3.5.5, 3.4.4, 3.3.6, 3.0.19, 1.1.1ze and 1.0.2zn
Release Announcement for OpenSSL Library 3.6.1, 3.5 5, 3.4.4, 3.3.6, 3.0.19, 1.1.1ze and 1.0.2zn The OpenSSL Project team announces the release of new versions of our open-source toolkit for SSL/TLS.
O
ENGINE code removed from the OpenSSL Library
OpenSSL 4.0, to be released in April 2026, is the first major release since 3.0 which replaced the ENGINE interface with Providers. Removing ENGINEs is a primary goal of this major release and this post describes the change agreed to by both the OpenSSL Corporation and OpenSSL Foundation. Summary All symbols defined in openssl/engine.h have been removed from the shared library in OpenSSL 4.0. Appl…
O
Vote now for the Foundation Business Advisory Committee
The voting from the Foundation BAC has been extended through December 21. If you want to participate in the future of the OpenSSL Foundation, please join the communities site and vote for your representative. The currently running elections are: Academics Individuals Distributions Large Business Small Business For details about how the election works, please consult the Foundation Election Guide.
O
OpenSSL Library is moving to clang-format
The OpenSSL Library would like to modernise and streamline development processes, especially to ensure effective code review and make the project easier for contributors to contribute to. As part of this effort, we will be making some changes to our coding style guidelines and adopting clang-format using the WebKit C coding style as enforced by clang-format. We will transition to using clang-forma…
O
OpenSSL 3.2 End Of Life
OpenSSL 3.2 series has reached its End of Life (EOL). As such it will no longer receive publicly available security fixes.
O
Contributors to the OpenSSL Library (September 2025)
September has come and gone, so it’s past time to recognize new contributors to the OpenSSL Library: author date PR xiaoloudongfeng 2025-09-02 fix length of digestinfo_sm3_der Pkeane22 2025-09-07 Fixed typo LuiginoC 2025-09-10 crypto/evp/bio_ok.c:Integer Overflow in BIO_f_reliable record parser leads to Out-of-Bounds Read ritesh006 2025-09-11 doc: clarify SSL_SESSION_get0_hostname notes jedenastka…
O
We Celebrate the Success of the Inaugural OpenSSL Conference in Prague
The OpenSSL Corporation and the OpenSSL Foundation celebrate the success of the inaugural OpenSSL Conference, held in Prague, October 7-9. This was the first time in the history of the OpenSSL Project that the full community met in person. Developers, legal experts, and users from academics, committers, distributions, individuals, large businesses, and small businesses came together to discuss pro…
O
Foundation Business Advisory Committee election
Believe it or not, it’s time to start the election process for the 2026 Foundation Business Advisory Committee (FBAC). Advisory committees play a critical role in the governance of the OpenSSL Foundation. This committee focuses on the strategic direction of the OpenSSL Foundation and our mission. Each of the six communities (Academics, Committers, Distributions, Individuals, Large Businesses and S…
O
Lightship Security and the OpenSSL Corporation Submit OpenSSL 3.5.4 for FIPS 140-3 Validation
Lightship Security, an Applus+ Laboratories company and accredited cryptographic security test laboratory, and the OpenSSL Corporation, the co-maintainer of the OpenSSL Library, announce the submission of OpenSSL version 3.5.4 to the Cryptographic Module Validation Program (CMVP) for FIPS 140-3 validation. This submission confirms that the code is complete and that all included algorithms have suc…
O
Release Announcement for OpenSSL 3.6.0
The final release of OpenSSL 3.6 is now live. We would like to thank all those who contributed to the OpenSSL 3.6 release, without whom the OpenSSL Library would not be possible.
O
OpenSSL Release Announcement for 3.5.4, 3.4.3, 3.3.5, 3.2.6, 3.0.18, 1.1.1zd and 1.0.2zm
Release Announcement for OpenSSL Library 3.5.4, 3.4.3, 3.3.5, 3.2.6, 3.0.18, 1.1.1zd and 1.0.2zm The OpenSSL Project team announces the release of new versions of our open-source toolkit for SSL/TLS.
O
Contributors to the OpenSSL Library (August 2025)
Among the 91 PRs approved in August, 6 were from people who hadn’t contributed to OpenSSL’s code base until now. author date PR zl523856 2025-08-03 [RISC-V] Further optimization for AES-128-CBC decryption performance ChillerDragon 2025-08-04 Improve english in endian comment ritoban23 2025-08-13 Fix potential null pointer dereference in pkey_dh_derive vkryl 2025-08-15 Android: Enable 16 KB ELF ali…
O
OpenSSL 3.6 Beta Release Announcement
The OpenSSL Project is pleased to announce that OpenSSL 3.6 Beta1 pre-release is available, adding significant functionality to the OpenSSL Library.