OpenSSL 4.0.0

OpenSSL 4.0.0 is a feature release with major additions, while also including several compatibility changes and removals of deprecated features.

Key changes:

Hex output of key data no longer includes the leading 00: prefix.
Signatures are now standardized to a 24-byte width, and other dumps to a 16-byte width.
Lower-bound checks are applied when using PKCS5_PBKDF2_HMAC with the FIPS provider.
AKID verification is added when using X509_V_FLAG_X509_STRICT.
Several additional checks have been added to the CRL verification process.
The way libcrypto performs global cleanup has changed, and atexit()-based cleanup is no longer performed.
BIO_snprintf() now uses libc's snprintf() instead of an internal implementation.
OPENSSL_cleanup() may run in a global destructor or may not run by default.
ASN1_STRING has been changed to be opaque.
const has been added to many function signatures, including several X509-related APIs.

Many features have also been removed:

Removal of SSLv2 Client Hello support
Removal of SSLv3 support
Removal of engines support
Removal of c_rehash; use openssl rehash instead
Removal of the msie-hack option
Removal of BIO_f_reliable()
Removal of custom EVP_CIPHER, EVP_MD, EVP_PKEY, EVP_PKEY_ASN1 method support
Removal of functions related to fixed SSL/TLS versions
Removal of ERR_get_state(), ERR_remove_state(), ERR_remove_thread_state()
Removal of darwin-i386 and darwin-ppc family targets

New features have also been added:

Encrypted Client Hello (ECH) support
RFC 8998-related support for sm2sig_sm3, curveSM2, curveSM2MLKEM768
cSHAKE support
ML-DSA-MU digest algorithm support
SNMP KDF and SRTP KDF support
Ability to defer self tests with -defer_tests during FIPS installation
Ability to choose static/dynamic VC runtime linkage on Windows
Negotiated FFDHE key exchange support in TLS 1.2

Overall, this release is a major version upgrade that expands the latest TLS/cryptographic features while cleaning up outdated protocols and legacy APIs.

OpenSSL 4.0.0

Key point

Details

Related