# What Is OpenSSL? Definition and Examples

> OpenSSL is an open-source cryptography toolkit made up of the libssl TLS library, the libcrypto library and the openssl command-line tool.

Source: https://ssl.sh/glossary/openssl/
Last updated: 2026-11-10

OpenSSL is one of the most widely deployed open-source implementations of [TLS](https://ssl.sh/glossary/tls/) and general-purpose cryptography. It provides libssl (the TLS protocol), libcrypto (algorithms plus X.509, ASN.1 and PKCS formats) and the `openssl` command-line program, used to create keys and [CSRs](https://ssl.sh/glossary/csr/), inspect and convert certificates, and test TLS connections. nginx, Apache, many language runtimes and countless appliances link against it. Version 3.0 introduced a provider architecture for plugging in algorithm implementations, the 1.1.1 series reached end of life in September 2023, and OpenSSL 3.5 added the post-quantum algorithms [ML-KEM](https://ssl.sh/glossary/ml-kem/) and ML-DSA.

## Why it matters
OpenSSL is the lingua franca of certificate work: almost every tutorial, CA installation guide and troubleshooting page uses its commands. Its ubiquity also means its bugs have wide impact; [Heartbleed](https://ssl.sh/glossary/heartbleed/) (CVE-2014-0160) in 2014 let attackers read server memory, including private keys, on many HTTPS sites, and prompted the LibreSSL fork. For servers, keeping the linked library patched matters more than the CLI version you use for one-off commands.

## Example
```bash
openssl version
openssl s_client -connect example.com:443 -servername example.com </dev/null
openssl x509 -in example.com.crt -noout -subject -issuer -dates
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out example.com.key
openssl req -new -key example.com.key -subj "/CN=example.com" -out example.com.csr
```

## Common misconceptions
- **OpenSSL is the SSL protocol.** It is a library that implements TLS and keeps the SSL name for historical reasons; modern builds disable SSL 3.0.
- **The openssl on macOS is OpenSSL.** `/usr/bin/openssl` on macOS is LibreSSL, whose options and defaults can differ.
- **Upgrading the package is enough.** Long-running services keep the old library loaded until they are restarted.

## Related terms

- [TLS](https://ssl.sh/zh/glossary/tls/): TLS 是 IETF 制定的传输层安全协议，为 HTTPS 等网络连接提供加密、完整性保护和服务器身份认证，是 SSL 的继任者。
- [X.509](https://ssl.sh/zh/glossary/x509/): X.509 是 ITU-T 制定的公钥证书标准格式，其互联网配置规范 RFC 5280 规定了 TLS 所用证书的结构和验证方法。
- [CSR](https://ssl.sh/zh/glossary/csr/): CSR 是证书签名请求，包含申请者的公钥和希望写入证书的身份信息，用私钥签名后提交给 CA 以申请证书。
- [PEM](https://ssl.sh/zh/glossary/pem/): PEM 是一种把 DER 二进制数据做 Base64 编码、再用 BEGIN 和 END 行包起来的文本格式，是存放证书和私钥最常见的方式。
- [Heartbleed](https://ssl.sh/zh/glossary/heartbleed/): Heartbleed 是 2014 年公开的 OpenSSL 漏洞（CVE-2014-0160），出在 TLS 心跳扩展上，任何人都能借此读取服务器内存片段，甚至包括私钥。
- [后量子密码](https://ssl.sh/zh/glossary/post-quantum-cryptography/): 后量子密码（PQC）是专为抵御大规模量子计算机攻击而设计的公钥密码算法，用来替代可能被量子计算机破解的 RSA 和 ECC。
- [ML-KEM](https://ssl.sh/zh/glossary/ml-kem/): ML-KEM 是 NIST 于 2024 年 8 月在 FIPS 203 中标准化的后量子密钥封装机制，源自 CRYSTALS-Kyber，用于抗量子的密钥建立。
- [PKCS#12](https://ssl.sh/zh/glossary/pkcs12/): PKCS#12 是一种用口令保护的二进制容器格式，可以把私钥、证书和证书链打包进一个文件，扩展名通常是 .p12 或 .pfx。