OpenSSL is a software library for applications that provide secure communications over computer networks against eavesdropping, and identify the party at the other end. It is widely used by Internet servers, including the majority of HTTPS websites.
OpenSSL contains an open-source implementation of the SSL and TLS protocols. The core library, written in the C programming language, implements basic cryptographic functions and provides various utility functions. Wrappers allowing the use of the OpenSSL library in a variety of computer languages are available.
The OpenSSL Software Foundation (OSF) represents the OpenSSL project in most legal capacities including contributor license agreements, managing donations, and so on. OpenSSL Software Services (OSS) also represents the OpenSSL project for support contracts.
OpenSSL is available for most Unix-like operating systems (including Linux, macOS, and BSD), Microsoft Windows and OpenVMS.
Project history
The OpenSSL project was founded in 1998 to provide a free set of encryption tools for the code used on the Internet. It is based on a fork of SSLeay by Eric Andrew Young and Tim Hudson, which unofficially ended development on December 17, 1998, when Young and Hudson both went to work for RSA Security. The initial founding members were Mark Cox, Ralf Engelschall, Stephen Henson, Ben Laurie, and Paul Sutton.
In 2018 OpenSSL version numbering skipped from 1.1.1 to 3.0.0, omitting 2 as a major version number to avoid a conflict with one of OpenSSL's modules. Version 3.0.0 was the first to use the Apache License.
, the OpenSSL management committee consisted of seven people and there are seventeen developers with commit access (many of whom are also part of the OpenSSL management committee). There were only two full-time employees (fellows) and the remainder were volunteers.
By 2024, there were fourteen employees.
The project had a total income of US$5.5 million in 2024. Development of TLS 1.3 was sponsored by Akamai.
Major version releases
+ OpenSSL release history Version Original release date Support until Comment Last minor version Official start of the OpenSSL project 0.9.1c (23 December 1998) Successor of 0.9.1c 0.9.2b (6 April 1999) Successor of 0.9.2b 0.9.3a (27 May 1999) Successor of 0.9.3a 0.9.4 (9 August 1999) Successor of 0.9.4 0.9.5a (1 April 2000) Successor of 0.9.5a 0.9.6m (17 March 2004) Successor of 0.9.6m 0.9.7m (23 February 2007) Successor of 0.9.7m 0.9.8zh (3 December 2015) Successor of 0.9.8n 1.0.0t () Successor of 1.0.0h Support for TLS/DTLS heartbeat Support for SCTP Support for TLS keying material exporter Support for DTLS key establishment for SRTP Next Protocol Negotiation PSS signatures in certificates, requests and certificate revocation lists (CRL) Support for password based recipient info for CMS Support for TLS 1.2 and TLS 1.1 Preliminary FIPS 140 capability for unvalidated 2.0 FIPS module Secure Remote Password protocol (SRP) support 1.0.1u () Successor of 1.0.1l Suite B support for TLS 1.2 and DTLS 1.2 Support for DTLS 1.2 TLS automatic elliptic curve (EC) selection API to set TLS supported signature algorithms and curves SSL_CONF configuration API TLS Brainpool support ALPN support CMS support for RSA-PSS, RSA-OAEP, ECDH and ANSI X9.42 FIPS 140 support 1.0.2u () Successor of 1.0.2h Support for BLAKE2 Support for ChaCha20-Poly1305 Support for X25519 Support for DANE and Certificate Transparency Support for CCM Ciphersuites Support for extended master secret SSLv2 removed Kerberos ciphersuite support removed RC4 and 3DES removed from DEFAULT ciphersuites in libssl Remove DSS, SEED, IDEA, CAMELLIA, and AES-CCM from the DEFAULT cipherlist 40 and 56 bit cipher support removed from libssl FIPS 140 support removed 1.1.0l () (LTS) Successor of 1.1.0i Support for TLS 1.3 Support for SHA-3 Support for X448 and Ed448 Support for SipHash Support for ARIA Support for multi-prime RSA Support for SM2, SM3 and SM4 Heartbeat removed QNX support removed 1.1.1w (11 September 2023) (LTS) Relicensed to the Apache License 2.0 FIPS 140-2 support re-added. Crypto Providers, as a replacement for Crypto Engines Support for CMP (Certificate Management Protocol) 3.0.22 (25 August 2026) FIPS 140-3 compliance Performance enhancements 3.1.8 (11 February 2025) Client-side QUIC support TLS Certificate compression Deterministic use of ECDSA TLS raw public keys 3.2.6 (30 September 2025) 3.3.7 (7 April 2026) Ongoing development (LTS) Support for PQC algorithms (ML-KEM, ML-DSA and SLH-DSA) Support for server side QUIC (RFC 9000) Support for 3rd party QUIC stacks including 0-RTT support Support added for opaque symmetric key objects (EVP_SKEY) A new configuration option no-tls-deprecated-ec to disable support for TLS groups deprecated in RFC8422 A new configuration option enable-fips-jitter to make the FIPS provider to use the JITTER seed source Support for central key generation in CMP Support for multiple TLS keyshares and improved TLS key establishment group configurability API support for pipelining in provided cipher algorithmsOngoing development Ongoing development Ongoing development
Algorithms
OpenSSL supports a number of different cryptographic algorithms: Ciphers AES, Blowfish, Camellia, ChaCha20, Poly1305, SEED, CAST-128, DES, IDEA, RC2, RC4, RC5, Triple DES, GOST 28147-89, SM4 Cryptographic hash functions MD5, MD4, MD2, SHA-1, SHA-2, SHA-3, RIPEMD-160, MDC-2, GOST R 34.11-94, BLAKE2, Whirlpool, SM3 Public-key cryptography RSA, DSA, Diffie–Hellman key exchange, Elliptic curve, X25519, Ed25519, X448, Ed448, GOST R 34.10-2001, SM2
(Perfect forward secrecy is supported using elliptic-curve Diffie–Hellman since version 1.0.)
FIPS 140 validation
FIPS 140 is a U.S. Federal program for the testing and certification of cryptographic modules. An early FIPS 140-1 certificate for OpenSSL's FOM 1.0 was revoked in July 2006 "when questions were raised about the validated module's interaction with outside software." The module was re-certified in February 2007 before giving way to FIPS 140-2. OpenSSL 1.0.2 supported the use of the OpenSSL FIPS Object Module (FOM), which was built to deliver FIPS approved algorithms in a FIPS 140-2 validated environment. OpenSSL controversially decided to categorize the 1.0.2 architecture as 'end of life' or 'EOL', effective December 31, 2019, despite objections that it was the only version of OpenSSL that was currently available with support for FIPS mode. As a result of the EOL, many users were unable to properly deploy the FOM 2.0 and fell out of compliance because they did not secure extended support for the 1.0.2 architecture, although the FOM itself remained validated for eight months further.
The FIPS Object Module 2.0 remained FIPS 140-2 validated in several formats until September 1, 2020, when NIST deprecated the usage of FIPS 186-2 for Digital Signature Standard and designated all non-compliant modules as 'Historical'. This designation includes a caution to federal agencies that they should not include the module in any new procurements. All three of the OpenSSL validations were included in the deprecation – the OpenSSL FIPS Object Module (certificate #1747), OpenSSL FIPS Object Module SE (certificate #2398), and OpenSSL FIPS Object Module RE (certificate #2473). Many 'private label' OpenSSL-based validations and clones created by consultants were also moved to the Historical List, although some FIPS validated modules with replacement compatibility avoided the deprecation, such as BoringCrypto from Google and CryptoComply from SafeLogic.
The OpenSSL Management Committee announced a change in the versioning scheme.
Due to this change, the major number of the next major version would have been doubled, since the OpenSSL FIPS module already occupied this number. Therefore, the decision was made to skip the OpenSSL 2.0 version number and continue with OpenSSL 3.0 .
OpenSSL 3.0 restored FIPS mode and underwent FIPS 140-2 testing, but with significant delays: The effort was first kicked off in 2016 with support from SafeLogic and further support from Oracle in 2017, but the process has been challenging.
On October 20, 2020, the OpenSSL FIPS Provider 3.0 was added to the CMVP Implementation Under Test List, which reflected an official engagement with a testing lab to proceed with a FIPS 140-2 validation. This resulted in a slew of certifications in the following months.
Licensing
OpenSSL was dual-licensed under the OpenSSL License and the SSLeay License, which means that the terms of either licenses can be used. The OpenSSL License is Apache License 1.0 and SSLeay License bears some similarity to a 4-clause BSD License. As the OpenSSL License was Apache License 1.0, but not Apache License 2.0, it requires the phrase "this product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit" to appear in advertising material and any redistributions (Sections 3 and 6 of the OpenSSL License). Due to this restriction, the OpenSSL License and the Apache License 1.0 are incompatible with the GNU GPL. Some GPL developers have added an OpenSSL exception to their licenses that specifically permits using OpenSSL with their system. GNU Wget and climm both use such exceptions. Some packages (like Deluge) explicitly modify the GPL license by adding an extra section at the beginning of the license documenting the exception. Other packages use the LGPL-licensed GnuTLS, BSD-licensed Botan, or MPL-licensed NSS, which perform the same task.
OpenSSL announced in August 2015 that it would require most contributors to sign a Contributor License Agreement (CLA), and that OpenSSL would eventually be relicensed under the terms of Apache License 2.0. This process commenced in March 2017, and was complete in 2018.
On 7 September 2021, OpenSSL 3.0.0 was released under the Apache License 2.0.
Notable vulnerabilities
Denial of service (DOS): ASN.1 parsing
OpenSSL 0.9.6k has a bug where certain ASN.1 sequences triggered a large number of recursions on Windows machines, discovered on November 4, 2003. Windows could not handle large recursions correctly, so OpenSSL would crash as a result. Being able to send arbitrary large numbers of ASN.1 sequences would cause OpenSSL to crash as a result.
OCSP stapling vulnerability
When creating a handshake, the client could send an incorrectly formatted ClientHello message, leading to OpenSSL parsing more than the end of the message. Assigned the identifier by the CVE project, this affected all OpenSSL versions 0.9.8h to 0.9.8q and OpenSSL 1.0.0 to 1.0.0c. Since the parsing could lead to a read on an incorrect memory address, it was possible for the attacker to cause a DoS. It was also possible that some applications expose the contents of parsed OCSP extensions, leading to an attacker being able to read the contents of memory that came after the ClientHello.
ASN.1 BIO vulnerability
When using Basic Input/Output (BIO) or FILE based functions to read untrusted DER format data, OpenSSL is vulnerable. This vulnerability was discovered on April 19, 2012, and was assigned the CVE identifier . While not directly affecting the SSL/TLS code of OpenSSL, any application that was using ASN.1 functions (particularly d2i_X509 and d2i_PKCS12) were also not affected.
SSL, TLS and DTLS plaintext recovery attack
In handling CBC cipher-suites in SSL, TLS, and DTLS, OpenSSL was found vulnerable to a timing attack during the MAC processing. Nadhem Alfardan and Kenny Paterson discovered the problem, and published their findings on February 5, 2013. The vulnerability was assigned the CVE identifier .
Predictable private keys (Debian-specific)