OpenSSL 4.0, to be released in April 2026, is the first major
release since 3.0 which replaced
the ENGINE interface with
Providers. Removing ENGINEs is a
primary goal of this major release and this post describes the change
agreed to by both the OpenSSL Corporation and OpenSSL Foundation.
Summary
All symbols defined in openssl/engine.h have been removed from the
shared library in
OpenSSL 4.0. Applications that use the ENGINE API will fail to compile
using the default build settings. This behavior matches what happens
in previous versions when building OpenSSL with the no-engine
configuration
option
with current versions. Up-to-date applications should not include
openssl/engine.h at all.
The OpenSSL Library would like to modernise and streamline development processes, especially to ensure effective code review and make the project easier for contributors to contribute to.
As part of this effort, we will be making some changes to our coding style guidelines and adopting clang-format using the WebKit C coding style as enforced by clang-format. We will transition to using clang-format to check pre-submissions and ensure code follows the format portions of the style guide before PRs are reviewed.
The OpenSSL Corporation and the OpenSSL Foundation celebrate the success of the inaugural OpenSSL Conference, held in Prague, October 7-9. This was the first time in the history of the OpenSSL Project that the full community met in person. Developers, legal experts, and users from academics, committers, distributions, individuals, large businesses, and small businesses came together to discuss project direction, share experience, and collaborate on the future of secure digital communication.
Believe it or not, it’s time to start the election process for the
2026 Foundation Business Advisory Committee (FBAC). Advisory
committees play a critical role in the governance of the OpenSSL
Foundation. This committee focuses on
the strategic direction of the OpenSSL Foundation and our
mission.
Each of the six communities (Academics, Committers, Distributions,
Individuals, Large Businesses and Small Businesses) will have a
representative who will serve for one year. In addition to a monthly
meeting, representatives also lead discussions on the Communities
platform and generally promote
the OpenSSL Mission.
Lightship Security, an Applus+ Laboratories company and accredited cryptographic security test laboratory, and the OpenSSL Corporation, the co-maintainer of the OpenSSL Library, announce the submission of OpenSSL version 3.5.4 to the Cryptographic Module Validation Program (CMVP) for FIPS 140-3 validation.
This submission confirms that the code is complete and that all included algorithms have successfully passed NIST testing and independent laboratory review. The final CMVP review and certificate issuance remain as the last step in the process.
The final release of OpenSSL 3.6 is now live. We would like to thank all those who contributed to the OpenSSL 3.6 release, without whom the OpenSSL Library would not be possible.
