OpenSSL

OpenSSL is one of the most widely deployed open-source implementations of TLS and general-purpose cryptography. It provides libssl (the TLS protocol), libcrypto (algorithms plus X.509, ASN.1 and PKCS formats) and the openssl command-line program, used to create keys and CSRs, inspect and convert certificates, and test TLS connections. nginx, Apache, many language runtimes and countless appliances link against it. Version 3.0 introduced a provider architecture for plugging in algorithm implementations, the 1.1.1 series reached end of life in September 2023, and OpenSSL 3.5 added the post-quantum algorithms ML-KEM and ML-DSA.

Why it matters

OpenSSL is the lingua franca of certificate work: almost every tutorial, CA installation guide and troubleshooting page uses its commands. Its ubiquity also means its bugs have wide impact; Heartbleed (CVE-2014-0160) in 2014 let attackers read server memory, including private keys, on many HTTPS sites, and prompted the LibreSSL fork. For servers, keeping the linked library patched matters more than the CLI version you use for one-off commands.

Example

openssl version
openssl s_client -connect example.com:443 -servername example.com </dev/null
openssl x509 -in example.com.crt -noout -subject -issuer -dates
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out example.com.key
openssl req -new -key example.com.key -subj "/CN=example.com" -out example.com.csr

Common misconceptions

• OpenSSL is the SSL protocol. It is a library that implements TLS and keeps the SSL name for historical reasons; modern builds disable SSL 3.0.
• The openssl on macOS is OpenSSL. /usr/bin/openssl on macOS is LibreSSL, whose options and defaults can differ.
• Upgrading the package is enough. Long-running services keep the old library loaded until they are restarted.