The 2026 OpenSSL Foundation Advisory Committee nomination period has started! The Foundation is looking for people who want to help guild the future of internet security and data privacy. Whether you are more comfortable on LinkedIn or GitHub, your advice matters. If you haven’t already, join a community. This is required in order to nominate someone or to vote in the election. It also opens the d
Over the past week a denial-of-service (DoS) report against OpenSSL, named “HollowByte” by the Okta Red Team who reported it, has received a good deal of press attention. A number of the articles ask reasonable questions about how we assessed the report and why we handled the fix the way we did. This post sets out our analysis and the reasoning behind our decisions. We are grateful to the Okta Red
The OpenSSL Library has adopted an AI policy. To summarize: Anyone who uses AI to provide a non-trivial portion of their contributions to the OpenSSL Library must: Sign an updated Contributor License Agreement (CLA) that includes the AI clauses. Declare any AI use in the commit message of each contribution. This is done via an Assisted-by trailer as explained in the policy. People who do not use A
At ICMC26, Tim Hudson announced a change to the OpenSSL Library release schedule for future releases. Last year we committed to making long term stable (LTS) releases every two years. Following the release of 4.0, the first major release since 2018, we now commit to a major release every two years. So the next LTS will be 4.2 in April 2027 and then we’ll have a major release, 5.0, in October 2027.
The final release of OpenSSL 4.0 is now live. We would like to thank all those who contributed to the OpenSSL 4.0 release, without whom the OpenSSL Library would not be possible.
Previous posts about the upcoming OpenSSL 4.0 release: removing ENGINE code removing deprecated functions for creating or modifying custom METHODS no longer registering a function via atexit function adding ECH support removing SSLv3 and SSLv2 Client Hello Summary The ASN1_STRING structure can no longer be accessed directly. Instead, accessor functions must be used. While these accessor functions
Release Announcement for OpenSSL Library 3.6.2, 3.5.6, 3.4.5, 3.3.7, 3.0.20, 1.1.1zg and 1.0.2zp The OpenSSL Project team announces the release of new versions of our open-source toolkit for SSL/TLS.
Previous posts about the upcoming OpenSSL 4.0 release: removing ENGINE code removing deprecated functions for creating or modifying custom METHODS no longer registering a function via atexit function adding ECH support Summary Secure Sockets Layer version 3.0 (SSLv3) was deprecated in RFC 7568. SSLv3 was disabled at build-time in OpenSSL 1.0.2h by default. As of OpenSSL 4.0, SSLv3 support has been
The OpenSSL Project is pleased to announce that OpenSSL 4.0 Beta1 pre-release is available, adding significant functionality to the OpenSSL Library.
The expiration date of the OpenSSL release signing key with fingerprint BA5473A2B0587B07FB27CF2D216094DFD0CB81EF has been extended from 08 Apr 2026 to 14 Jun 2026. Only the key expiration date has changed. The signing key itself remains the same. The updated public key is available at: https://keys.openpgp.org/search?q=BA5473A2B0587B07FB27CF2D216094DFD0CB81EF
Previous posts about the upcoming OpenSSL 4.0 release: removing ENGINE code removing deprecated functions for creating or modifying custom METHODS no longer registering a function via atexit function Summary The OpenSSL Library now supports Encrypted Client Hello (ECH) specified in RFC 9849, which was published this month. Applications that implement this standard will be able to encrypt sensitive
Previous posts about features removed from OpenSSL 4.0: ENGINE code deprecated functions for creating or modifying custom METHODS Summary The OPENSSL_cleanup() function is no longer registered to be called upon the termination of the process. This means the OpenSSL Library does not automatically free resources so the operating system reclaims them when an application exits. For most users, this wi
The OpenSSL Project is announcing the upcoming release of OpenSSL 4.0 Alpha, scheduled for March 10, 2026. As a result, the repository will be frozen before the release on February 24, 2026.
Following on from the removal of ENGINE code, deprecated functions for creating or modifying custom METHODS will be removed from OpenSSL 4.0. Summary For a complete list of deprecated functions removed in OpenSSL 4.0, please see the ossl-removed-api documentation. They are divided into the following pull requests: Custom ciphers methods (EVP_CIPHER_meth_*) were removed in PR #29299. Custom message
Release Announcement for OpenSSL Library 3.6.1, 3.5 5, 3.4.4, 3.3.6, 3.0.19, 1.1.1ze and 1.0.2zn The OpenSSL Project team announces the release of new versions of our open-source toolkit for SSL/TLS.
OpenSSL 4.0, to be released in April 2026, is the first major release since 3.0 which replaced the ENGINE interface with Providers. Removing ENGINEs is a primary goal of this major release and this post describes the change agreed to by both the OpenSSL Corporation and OpenSSL Foundation. Summary All symbols defined in openssl/engine.h have been removed from the shared library in OpenSSL 4.0. Appl
The voting from the Foundation BAC has been extended through December 21. If you want to participate in the future of the OpenSSL Foundation, please join the communities site and vote for your representative. The currently running elections are: Academics Individuals Distributions Large Business Small Business For details about how the election works, please consult the Foundation Election Guide.
The OpenSSL Library would like to modernise and streamline development processes, especially to ensure effective code review and make the project easier for contributors to contribute to. As part of this effort, we will be making some changes to our coding style guidelines and adopting clang-format using the WebKit C coding style as enforced by clang-format. We will transition to using clang-forma
OpenSSL 3.2 series has reached its End of Life (EOL). As such it will no longer receive publicly available security fixes.
September has come and gone, so it’s past time to recognize new contributors to the OpenSSL Library: author date PR xiaoloudongfeng 2025-09-02 fix length of digestinfo_sm3_der Pkeane22 2025-09-07 Fixed typo LuiginoC 2025-09-10 crypto/evp/bio_ok.c:Integer Overflow in BIO_f_reliable record parser leads to Out-of-Bounds Read ritesh006 2025-09-11 doc: clarify SSL_SESSION_get0_hostname notes jedenastka
The OpenSSL Corporation and the OpenSSL Foundation celebrate the success of the inaugural OpenSSL Conference, held in Prague, October 7-9. This was the first time in the history of the OpenSSL Project that the full community met in person. Developers, legal experts, and users from academics, committers, distributions, individuals, large businesses, and small businesses came together to discuss pro
Believe it or not, it’s time to start the election process for the 2026 Foundation Business Advisory Committee (FBAC). Advisory committees play a critical role in the governance of the OpenSSL Foundation. This committee focuses on the strategic direction of the OpenSSL Foundation and our mission. Each of the six communities (Academics, Committers, Distributions, Individuals, Large Businesses and S
Lightship Security, an Applus+ Laboratories company and accredited cryptographic security test laboratory, and the OpenSSL Corporation, the co-maintainer of the OpenSSL Library, announce the submission of OpenSSL version 3.5.4 to the Cryptographic Module Validation Program (CMVP) for FIPS 140-3 validation. This submission confirms that the code is complete and that all included algorithms have suc
The final release of OpenSSL 3.6 is now live. We would like to thank all those who contributed to the OpenSSL 3.6 release, without whom the OpenSSL Library would not be possible.
Release Announcement for OpenSSL Library 3.5.4, 3.4.3, 3.3.5, 3.2.6, 3.0.18, 1.1.1zd and 1.0.2zm The OpenSSL Project team announces the release of new versions of our open-source toolkit for SSL/TLS.
Among the 91 PRs approved in August, 6 were from people who hadn’t contributed to OpenSSL’s code base until now. author date PR zl523856 2025-08-03 [RISC-V] Further optimization for AES-128-CBC decryption performance ChillerDragon 2025-08-04 Improve english in endian comment ritoban23 2025-08-13 Fix potential null pointer dereference in pkey_dh_derive vkryl 2025-08-15 Android: Enable 16 KB ELF ali
Release Announcement for OpenSSL Library 3.5.3 The OpenSSL Project team announces the release of new versions of our open-source toolkit for SSL/TLS.
The OpenSSL Project is pleased to announce that OpenSSL 3.6 Beta1 pre-release is available, adding significant functionality to the OpenSSL Library.
The OpenSSL Project is pleased to announce that OpenSSL 3.6 Alpha1 pre-release is released and adding significant new functionality to OpenSSL Library.
In July, 58 pull requests were approved for merge into the OpenSSL Library code base. There were also four people who contributed code for the first time: yzpgryx provided a fix to support the SM2 PEM format with matching tests. caolanm designated an unchanging structure to be constant. igus68 found a good first issue and fixed it. Before this fix, the OpenSSL cryptographic library would accept a
Early Bird registration is now open for the inaugural OpenSSL Conference, taking place from October 7 to 9, 2025, in Prague, Czech Republic. Take advantage of exclusive Early Bird rates and secure your spot now! Join the global community of cryptographers, open-source innovators, security experts, and thought leaders who shape the future of secure communications. The OpenSSL Conference promises to
The freeze date for OpenSSL 3.6 Alpha is rapidly approaching. If you have a feature ready, please ensure that your associated PRs are posted, reviewed, and ready to be merged before the include/exclude decision date (Tuesday, August 5, 2025) and merged before the repository freeze date (Tuesday, August 19, 2025). Otherwise, the feature will be postponed until the next release.
Every month the OpenSSL Library receives code in the form of pull requests (PR) to GitHub. In June, 64 of those PRs were merged into the default branch of the repository thus becoming a part of the OpenSSL Library code base. Some of those changes came from developers paid by either the OpenSSL Foundation or the OpenSSL Corporation. Some of the changes come from developers who work for another comp
Recently we opened a short survey for people to share their OpenSSL stories. We’ve already heard from people who use OpenSSL to: Analyze QUIC traffic. Secure school cafeteria point of sale (POS) systems. Protect letters sent digitally to a printer before they are sent physically, on paper, via the postal system. Generate a JSON Web Token (JWT) from a PEM (Privacy Enhanced Mail) file without depend
Release Announcement for OpenSSL Library 3.5.1, 3.4.2, 3.3.4, 3.2.5, and 3.0.17 The OpenSSL Project team announces the release of new versions of our open-source toolkit for SSL/TLS. CVEs fixed in 3.5.1: CVE-2025-4575 - LOW - Fix x509 application adds trusted use instead of rejected use. All other releases contain miscellaneous minor bug fixes. For details of the changes, refer to the release note
Please note that we are no longer accepting new applications for this position. OpenSSL Foundation is seeking a talented and motivated Software Engineer (C Developer) to contribute to the development and maintenance of the widely-used OpenSSL open-source cryptographic library.
If you’re reading this blog post, you probably don’t need us to tell you how essential, widespread, and important the OpenSSL Library is. While our open source model means that everyone is freely able to use these tools, it also means we here at the OpenSSL Foundation don’t actually know all the great stories of how these tools are being used. We’re looking for real stories of how the OpenSSL Libr
The OpenSSL Conference 2025 is extending its Call for Papers (CFP) deadline to June 22, 2025. We understand that the best proposals often come from teams deep in the trenches of real-world security work. You now have additional time to craft and submit the talk, panel, or workshop that challenges assumptions, advances cryptographic innovation, drives and shapes the future of secure communications.
Pictured here from left to right: Štefan Kremeň (Support Manager), Peter Gutmann (cryptlib), Hana Andersen (Marcom Manager), Shayne Jones (cryptlib), Kajal Sapkota (MarCom Specialist), Kateřina Míčová (Business Admin), Daniela Kellnerová (MarCom Specialist), Norbert Pócs (Software Engineer), Tomáš Vávra (Engineering & Standards Mgr.), Anton Arapov (Operations Manager), Tim Hudson (Corporation Pres
The OpenSSL Corporation and the OpenSSL Foundation are launching the Distinguished Contributor Awards, a new programme formally recognising exceptional technical contributions to each OpenSSL Library release. These awards highlight individuals who drive critical advancements and demonstrate technical leadership in the evolution of the OpenSSL Library.