OpenSSL

OpenSSL
Software: OpenSSL contributorsScreenshot: VulcanSphere · Apache License 2.0 · source
Name	OpenSSL
Title	OpenSSL
Developer	OpenSSL Project
Released	1998
Latest release	1.1.1 / 3.0.x
Operating system	Linux, FreeBSD, NetBSD, OpenBSD, Solaris, Microsoft Windows, macOS
Genre	Cryptography library
License	Apache License 2.0 (formerly OpenSSL License)

OpenSSL is a widely used open-source cryptographic software library that provides implementations of the Transport Layer Security, Secure Sockets Layer, and a suite of cryptographic algorithms. It is embedded in many Linux distributions, Apache, Nginx, Postfix, Dovecot, OpenSSH, curl, and LibreOffice derivatives. Developed and maintained by the OpenSSL Project, the library interoperates with standards implemented by organizations such as the Internet Engineering Task Force and the National Institute of Standards and Technology.

History

The project originated in the late 1990s as a fork and continuation of the SSLeay implementation, created by Eric A. Young and Tim J. Hudson. Early adoption followed endorsements from the Internet Society and alignment with IETF specifications like RFC 2246 and RFC 4346. Over time, contributions and scrutiny increased after high-profile incidents involving Heartbleed which drew attention from institutions such as Google, CERN, Red Hat, Debian Project, Canonical, Microsoft Corporation, Intel, and Amazon Web Services. Subsequent audits were funded or coordinated with help from organizations like the Open Technology Fund, Linux Foundation, Core Infrastructure Initiative, Qualcomm, Facebook, and Mozilla Foundation.

Architecture and Components

OpenSSL's modular design includes a crypto library, a TLS/SSL implementation, and command-line utilities used by projects like Apache, Nginx, Postfix, Dovecot, and OpenVPN. Core components include the libcrypto cryptographic primitive library and libssl protocol handlers that implement specs from the IETF TLS Working Group and RFCs authored by figures such as Eric Rescorla and Tim Dierks. Platform adapters integrate with OpenSSL engines and hardware acceleration from vendors like Intel Corporation, NVIDIA, ARM, and AMD. Build systems support toolchains such as GNU Compiler Collection, Clang, and Microsoft Visual C++. Utilities interact with standards and formats like X.509, ASN.1, PKCS#12, and PEM used by projects including Let's Encrypt, Certbot, cURL, and GnuTLS.

Cryptographic Features and Protocols

The library implements symmetric ciphers (e.g., AES, ChaCha20), block modes (e.g., CBC), and authenticated encryption schemes (e.g., GCM). Public-key algorithms include RSA, Elliptic Curve Cryptography such as secp256r1, ECDSA, and Diffie–Hellman. Hash functions supported include SHA-1, SHA-2, and SHA-3 families specified by NIST standards, alongside message authentication codes like HMAC. Protocol support covers SSL 3.0, multiple TLS versions including the draft implementations used when interoperating with IETF QUIC experiments, and extensions such as ALPN, SNI, OCSP stapling, and TLS session resumption that affect ecosystems like HTTP/2, HTTP/3, SMTP, and IMAP services run by providers such as Google LLC, Microsoft Exchange, Yahoo!, and Fastmail.

Security Vulnerabilities and Audits

Notable security incidents triggered broad community responses: the Heartbleed vulnerability prompted coordinated emergency responses from vendors including Red Hat, Debian Project, Ubuntu, SUSE, CentOS, and cloud providers like Amazon Web Services and Google Cloud Platform. Subsequent formal audits were performed by security firms and academic teams allied with the Core Infrastructure Initiative, involving auditors such as Codenomicon, NCC Group, Rogue Wave Software, and researchers from University of Cambridge, Carnegie Mellon University, Stanford University, and ETH Zurich. Hardening efforts included fuzzing campaigns using tools like American Fuzzy Lop, static analysis from Coverity, and formal verification techniques influenced by projects such as OpenBSD's LibreSSL fork and formal methods work at Microsoft Research. Patches addressing vulnerabilities have been coordinated with incident response teams at CERT Coordination Center, US-CERT, and vendor security teams across Red Hat, Debian Project, Canonical, and Apple Inc..

Licensing and Governance

The project's licensing evolved from the original OpenSSL License to compatibility with the Apache License 2.0 to better align with major projects such as Apache Software Foundation, Mozilla Foundation, Linux Foundation, and corporate users including IBM, Oracle Corporation, Google LLC, and Microsoft Corporation. Governance is community-driven through the OpenSSL Project which includes individual contributors, vendor stakeholders like Red Hat, Huawei Technologies, F5 Networks, and advisory input from foundations such as the Linux Foundation and funding initiatives like the Core Infrastructure Initiative and Open Technology Fund. Legal and export considerations interact with frameworks such as Wassenaar Arrangement and standards bodies including the IETF and ISO.

Deployments and Usage Examples

OpenSSL-based stacks power web servers like Apache HTTP Server, Nginx, Lighttpd, and reverse proxies used by Cloudflare, Akamai Technologies, and Fastly. Mail transport and retrieval implementations such as Postfix, Exim, Dovecot, and Courier Mail Server use the library for STARTTLS and SMTPS. Client tooling includes cURL, Wget, OpenSSH, GnuPG integrations, and language bindings for Python's Requests ecosystem, Perl, Ruby, PHP, Java wrappers, and Go's cgo-based interfaces. Cryptographic appliances and VPN platforms such as OpenVPN, strongSwan, IPsec implementations, and embedded systems from Cisco Systems, Juniper Networks, and Arista Networks rely on OpenSSL primitives. Certificate authorities and automation services like Let's Encrypt, Certbot, Entrust, DigiCert and enterprise solutions from Microsoft Corporation and Entrust use OpenSSL formats and tools in issuance pipelines.

Category:Cryptographic libraries