OpenSSL: TLS/SSL and cryptographic toolkit
C-based cryptographic library implementing TLS, DTLS, and QUIC protocols.
Learn more about openssl
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes
Modular architecture
Separates protocol implementations (libssl) from cryptographic primitives (libcrypto), allowing libcrypto to be used independently for non-TLS cryptographic tasks. This design enables flexible integration into applications with varying security requirements.
Multiple protocol support
Implements TLS versions up to 1.3, DTLS for datagram-based communication, and QUIC for modern transport protocols. Single toolkit covers legacy SSL/TLS compatibility alongside contemporary protocol standards.
FIPS validation
Includes a cryptographic module validated to conform with FIPS standards, enabling deployment in regulated environments with specific cryptographic certification requirements.
import https from 'https';
import fs from 'fs';
const options = {
key: fs.readFileSync('key.pem'),
cert: fs.readFileSync('cert.pem')
};
const server = https.createServer(options, (req, res) => {
res.writeHead(200);
res.end('Secure connection established');
});
server.listen(443);Requires C99 compiler; VxWorks support removed. Adds symmetric key objects, LMS signature verification, and FIPS 186-5 deterministic ECDSA.
- –Upgrade build toolchain to C99-compliant compilers; ANSI-C is no longer sufficient.
- –Migrate off VxWorks platforms and deprecated EVP_PKEY_ASN1_METHOD functions before upgrading.
Security patch fixing three moderate CVEs (out-of-bounds reads/writes in RFC 3211 KEK, SM2 timing leak, HTTP no_proxy); reverts OPENSSL_VERSION_NUMBER change that broke apps.
- –Upgrade to patch CVE-2025-9230 (RFC 3211 KEK unwrap OOB), CVE-2025-9231 (SM2 timing on ARM64), and CVE-2025-9232 (HTTP client no_proxy OOB read).
- –Note OPENSSL_VERSION_NUMBER now matches 3.x semantics again; apps relying on the reverted behavior may need adjustment.
Security patch fixing three moderate CVEs: out-of-bounds issues in RFC 3211 KEK unwrap and HTTP no_proxy handling, plus a timing side-channel in SM2 on ARM64.
- –Upgrade immediately if using RFC 3211 key unwrap, SM2 on 64-bit ARM, or HTTP client no_proxy features to close memory safety and timing vulnerabilities.
- –No breaking changes or migration steps specified; patch addresses CVE-2025-9230, CVE-2025-9231, and CVE-2025-9232.
Top in Security
Related Repositories
Discover similar tools and frameworks used by developers
ghidra
NSA's open-source tool for analyzing compiled binaries.
DVWA
PHP/MariaDB training platform for web security exploitation practice.
httpx
Fast HTTP probing with response metadata extraction.
CyberChef
Browser-based data transformation tool with chainable operations.
sigma
YAML-based detection rules with SIEM query conversion.