openssl-4.1.0

[Bruce Dubbs]

New minor version.

[Bruce Dubbs]

Changes between 4.0 and 4.1.0 [23 Oct 2026]

• Changed the OpenSSL FIPS provider so that every algorithm advertised with fips=yes explicitly exposes the fips-indicator as a gettable context parameter and returns 1 for an approved operation. The absence of an indicator is no longer interpreted as approval. Algorithms advertised with fips=no, including X448MLKEM1024, remain unapproved and return 0 when they expose the indicator.

• Changed TLS 1.3 clients to offer a PSK, and to attempt 0-RTT early data, only when it can actually be used. A resumption ticket or external PSK is offered only if some offered ciphersuite shares its handshake digest, and 0-RTT is attempted only if the first offered PSK's exact ciphersuite and, where recorded, its ALPN protocol are offered and, for a ticket, it has not aged out. When 0-RTT is not viable the client keeps the PSK for a 1-RTT handshake. In particular a client-detected ALPN inconsistency now suppresses 0-RTT rather than failing with SSL_R_INCONSISTENT_EARLY_DATA_ALPN.

Fixed TLS 1.3 clients to reject a psk_use_session callback PSK whose master key is empty, with SSL_R_BAD_PSK, instead of failing later in binder computation.

• Added support for DTLS 1.3 ([RFC 9147]). Refer to the ossl-guide-dtlsv13(7) manual page for details.

• Added support for [RFC 8701] GREASE (Generate Random Extensions And Sustain Extensibility). When SSL_OP_GREASE is set, the TLS client injects reserved GREASE values into cipher suites, supported versions, supported groups, signature algorithms, key share, and extensions in the ClientHello to prevent ecosystem ossification. Added -grease option to openssl s_client to enable this.

• Added support for Ed25519 and Ed448 certificates in DTLS 1.2. Previously, these certificate types were only supported in TLS 1.2 and TLS 1.3.

• Added DTLS support to the SSL listener API. SSL_new_listener() can now create a DTLS listener that demultiplexes incoming datagrams into per-peer connections accepted with SSL_accept_connection(). The listener performs address validation (HelloVerifyRequest for DTLS 1.0/1.2, HelloRetryRequest cookie for DTLS 1.3) by default; pass SSL_LISTENER_FLAG_NO_VALIDATE to disable it. Refer to the SSL_new_listener(3) manual page for details.

• Added configurable values for DTLS listeners, accessed via SSL_get_value_uint()/SSL_set_value_uint(): SSL_VALUE_DTLS_LISTENER_MAX_PENDING_CONNS, SSL_VALUE_DTLS_LISTENER_PENDING_TIMEOUT, and SSL_VALUE_DTLS_LISTENER_MAX_DGRAM_SIZE. Refer to the SSL_get_value_uint(3) manual page for details.

• Implemented an ability to configure additional QUIC transport parameters via the SSL_get_value_uint()/SSL_set_value_uint() functions: max_udp_payload_size, initial_max_data, initial_max_stream_data_bidi_local, initial_max_stream_data_uni, ack_delay_exponent, and max_ack_delay.

• Simplified EC key point format handling.

The point conversion form (compressed, uncompressed, or hybrid) is now a single value on the EC_GROUP and round-trips unchanged through import and export of EC_KEY objects.

Freshly generated keys have their public point encoded in uncompressed form. A point-format supplied at key generation time via OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT is validated (an invalid value is rejected) but otherwise ignored on the generated key. EC parameter generation continues to honour the requested form on the group's generator; imported keys keep their form.

The ec_point_formats extension no longer affects TLS 1.2 X.509 certificate selection or acceptance. OpenSSL now accepts an EC certificate in any point form it can decode, and sends any EC certificate it has regardless of point form. TLS 1.3 disregards the extension entirely.

The [RFC 4492][RFC 4492 Section 5.1.2]/[8422 section 5.1.2][RFC 8422 Section 5.1.2] requirement that the peer's point-format list contain "uncompressed" is now enforced on both sides (previously client-only), and only when an ECC TLS 1.2 ciphersuite is negotiated—a missing "uncompressed" is ignored under TLS 1.3 or with a non-ECC cipher.

• Added a new verification error, X509_V_ERR_DUPLICATE_EXTENSION, with a descriptive message for certificates containing duplicate X.509 extensions, which are explicitly prohibited by [RFC 5280].

• Implemented extended support of metadata for symmetric key objects (EVP_SKEY).

• Added CMS_VERIFY_PARTIAL flag to CMS_verify(), -verify_partial option to openssl cms -verify operation, and CMS_SignerInfo_get_verification_result() and CMS_SignerInfo_get0_signer_cert() functions.

If the CMS_VERIFY_PARTIAL flag is set, the CMS_verify() call is successful if at least one of the individual signatures can be verified (as opposed to all of them), which may be useful to gracefully handle various situations, like missing CAs, expired certificates, or unsupported algorithms; applications can call CMS_get0_signers() to check if the set of valid signatures satisfies its policy, or use CMS_SignerInfo_get_verification_result() and CMS_SignerInfo_get0_signer_cert() functions to access the detailed verification results.

• Added OSSL_CMP_OPT_NONMATCHED_ERROR_NONCES option for OSSL_CMP_CTX and a corresponding -nonmatched_error_nonces option for the openssl cmp command.

• Changed the output of the -disabled option for the openssl list command to display disabled features, protocols, and algorithms, in relevant sections.

• Added -n option for the openssl rand command to suppress the trailing newline in hexadecimal output mode.

• Added -testmode option for the openssl s_time command.

• Added ability to utilise memory-mapped I/O when reading raw input from a file for one-shot sign/verify operations (such as Ed25519, Ed448, and ML-DSA) to openssl pkeyutl command on platforms that support it (Unix-like). The openssl dgst command uses the same approach for one-shot sign/verify when the input is from a file, removing the previous 16 MB limit for file-based input. This improves performance and supports large files without doubling memory use. Other platforms and stdin input continue to use the existing buffer-based implementation.

• Added a seed_strict option to the random configuration section, which makes the configured random seed source strictly enforced when a provider (such as the FIPS provider) requests entropy or a nonce.

When a provider requests seeding material before the primary DRBG has been created, the request falls back to the operating system entropy sources, because the seed source only comes into existence as a side effect of creating the primary DRBG. Whether a configured seed source is used therefore depends on operation order. With seed_strict enabled, the seed source is instead instantiated on demand and an error is reported if it cannot be used. The option is off by default with two exceptions: the JITTER seed source seeds strictly unless the option disables it, and enable-fips-jitter builds always seed strictly. Additionally, the property query used to fetch the default seed source can now be set at build time with -DOPENSSL_DEFAULT_SEED_PROPQ.

• Added IKEV2 KDF (EVP_KDF-IKEV2KDF) to EVP_KDF.

• Added CRYPTO_atomic_load_ptr, CRYPTO_atomic_store_ptr, and CRYPTO_atomic_cmp_exch_ptr functions to libcrypto, that implement the respective atomic operations with a locking-based fallback on platforms that do not support them.

• Added EVP_EC_affine2oct() function, that converts the affine coordinates of an EC point to an octet string conforming to [Section 2.3.4 of SECG SEC 1][SECG SEC 1 Section 2.3.4] ("Elliptic Curve Cryptography") standard.

• Added EVP_KDF_CTX_get0_kdf() and EVP_KDF_CTX_get1_kdf() functions as a replacement for the now deprecated EVP_KDF_CTX_kdf().

• Added ASN1_STRING_new_not_owned() function to libcrypto. It provides the ability to construct an ASN1_STRING with data for which ownership is not taken by the created ASN1_STRING object.

• Added ASN1_STRING_set1_data(), ASN1_STRING_set1_string(), and ASN1_STRING_get_length() API functions, and deprecated ASN1_STRING_set() and ASN1_STRING_length().

The new setter functions do not append a terminating NUL byte to the newly allocated strings, contrary to historic ASN1_STRING_set()'s behaviour, so ASN1_STRING_get0_data() may return data not followed by an out-of-ASN1_STRING_get_length() bounds NUL byte (whose presence has never been guaranteed there by API contract) in more cases than it used to before. A future release will switch to the usage of the new APIs internally.

When OpenSSL is built with AddressSanitizer or MemorySanitizer support, or is run under Valgrind having been built where the Valgrind headers are installed, the added NUL byte is marked inaccessible, so treating the result of ASN1_STRING_get0_data() as a C string (strlen(), %s, strdup() and the like) is reported as an error. All such uses must be changed to honour ASN1_STRING_get_length(). The Valgrind check may be disabled by building with -DOPENSSL_NO_VALGRIND_CHECK.

• Added CMS_add_standard_smimecap_ex() API function, which populates an SMIMECapabilities list using EVP_CIPHER_fetch() and EVP_MD_fetch() so that only algorithms available in the active providers are advertised. PKCS7_sign_add_signer() was updated in the same way, so that legacy ciphers, such as RC2 and DES, are no longer included in SMIMECapabilities by default when only the default provider is loaded.

• Added CTLOG_STORE_add0_log() function to add individual CT logs to a CTLOG_STORE.

• Added FIPS_mode() macro as a convenience alias to EVP_default_properties_is_fips_enabled(NULL), which is a shorthand to check whether the fips=yes property is currently enabled in the default library context.

• Refactored remaining cipher OSSL_PARAM name parsing so that automatically generated parsers are used instead of OSSL_PARAM_locate() calls. This should ensure that the list of acceptable parameters better matches those which are actually processed. It should also provide a small performance improvement, because repeated iteration over passed parameter arrays is avoided.

• Improved interoperability with TPM 1.2 Endorsement Key certificates per [TCG Credential Profiles specification Version 1.2, Section 3.2.7]: SubjectPublicKeyInfo blobs whose AlgorithmIdentifier uses id-RSAES-OAEP (NID_rsaesOaep, 1.2.840.113549.1.1.7) with a plain RSAPublicKey body are now decoded as RSA keys. The OAEP AlgorithmIdentifier parameters are not interpreted.

• Do not issue TLS 1.3 session tickets if the server has explicitly disabled them via SSL_OP_NO_TICKET and also turned off the session cache with SSL_SESS_CACHE_OFF. Both conditions together indicate a clear intent to suppress resumption, so sending NewSessionTicket messages would be wasteful and misleading. TLS 1.3 client that does not send the psk_key_exchange_modes extension, or that sends it together with [RFC 9149] parameters such as new_session_count = 0 or resumption_count = 0, is effectively signaling no interest in session tickets and session resumption.

• Improved DTLS handshake robustness under UDP reordering by buffering and replaying early ChangeCipherSpec (CCS) records at the expected state.

• Added VC-WIN32-MSVC2013 and VC-WIN64A-MSVC2013 build targets to provide internal functions for bridging the gaps in C99 standard support that are present in MSVC 2013.

• Added support for the (BSD-specific) mdoc format for the manual pages output, which can be selected via --manpage-format=mdoc configuration option. It requires presence of pod2mdoc utility in order for it to work.

• Added unit tests setup activated via enable-unit-tests option. This works only on platforms with ld --wrap support (Linux, BSD).

• Added test framework for testing function memory allocation failures.

• Updated header files to reflect modern development practices: all include files now have header guards and they are self-contained (they include all dependencies they need to be included on their own).

• Fixed a bug where a TLS 1.3 session ticket could retain a stale ALPN protocol from an earlier connection after a resumption negotiated a different protocol (or none), on both the server and the client, which could otherwise affect a later 0-RTT decision.

• Fixed SSL_listen_ex() to correctly adopt a QUIC connection and to preserve queued connections on allocation failure. Invalid arguments, including non-QUIC SSL objects, and internal failures now return -1, reserving 0 for "no connection available".

• Fixed QUIC child objects to inherit the effective flags of their explicit event domain. SSL_get0_domain() now reports that domain for connections and streams in the hierarchy.

• Fixed TLS 1.3 clients to encrypt 0-RTT early data with the first offered PSK identity ([RFC 9846 Section 4.3.10]) when a 0-RTT-capable resumption ticket has aged out and an external PSK is offered in its place. The early data was being encrypted with the retired ticket's secret, rather than the external PSK's, causing the server to reject it with a bad record MAC.

• Fixed TLS 1.3 servers to reject early data when a resumed PSK's ticket age is outside tolerance, per [RFC 9846], instead of accepting 0-RTT data from a ticket that has aged out.

• Fixed TLS 1.3 external PSK connections being wrongly rejected when the client sets a non-empty session ID context.

• Fixed a TLS 1.3 server with no session ID context to accept external PSK connections and to stop issuing unusable session tickets.

• Fixed TLS 1.3 servers to reject early data when the selected ciphersuite differs from the ciphersuite associated with the selected PSK. Same-hash PSK resumption can still continue without accepting 0-RTT data.

• Fixed X.509v3 extension configuration parsing to reject repeated fields in the basicConstraints, basicAttConstraints, and policyConstraints X.509v3 extension configurations, instead of silently using the last value.

• Fixed X.509 verification of certificate chains that use DSA signatures with SHA-384 or SHA-512 by registering dsa_with_SHA384 and dsa_with_SHA512 in the signature-algorithm cross-reference table.

• Fixed CMS_SignerInfo_verify() to no longer accept signature algorithm identifiers as valid digestAlgorithms, in violation of [RFC 5652].

• Fixed reading of binary data (for example, certificates in DER format) by openssl command from stdin on Windows.

• Fixed CRL scope checking for certificates without a CRL distribution points extension. A CRL having an issuing distribution point extension including a name that matches the certificate issuer name or any issuerAltName of the certificate is now accepted, as required by the default distribution point rule at the end of [RFC 5280 Section 6.3.3], instead of being rejected with X509_V_ERR_DIFFERENT_CRL_SCOPE.

• TLS clients no longer send the TLS padding extension ([RFC 7685]). It was only ever sent when SSL_OP_TLSEXT_PADDING was set, to work around a ClientHello length bug in F5 middleboxes; the fix shipped long ago and the affected hardware is long out of support, so nothing should still be running the problematic version. SSL_OP_TLSEXT_PADDING is now a no-op retained for compatibility, and is no longer included in SSL_OP_ALL.

• Changed tsget utility to use Net::Curl::Easy (from the Net-Curl CPAN distribution) instead of the abandoned WWW::Curl::Easy. Users who rely on tsget should install Net::Curl::Easy before upgrading.

• Deprecated the enable-unit-test configure option and the SSL_test_functions() function. Both will be removed in OpenSSL 5.0.

• Deprecated BIO_snprintf() and BIO_vsnprintf(). snprintf(), being part of C99 standard, that is the baseline for OpenSSL since version 3.6, is now considered universally available; moreover, the fact that BIO_*() functions return -1 on truncation, rather than the would-have-been length, makes their usage error-prone. Use snprintf() and vsnprintf() directly.

• Deprecated undocumented public functions UTF8_putc() and UTF8_getc(). No public replacement is planned.

• Deprecated EVP_CIPHER_CTX_get_num() and EVP_CIPHER_CTX_set_num() functions. Refer to ossl-migration-guide(7) for more info.

• Deprecated ASN1_BIT_STRING_name_print(), ASN1_BIT_STRING_num_asc(), and ASN1_BIT_STRING_set_asc() functions. Refer to the manual pages for more information.

• Deprecated ASN1_BIT_STRING_set() function in favour of ASN1_BIT_STRING_set1().

• Deprecated CMS_stream() and PKCS7_stream() API functions. These are internal plumbing that was unintentionally exposed as the public API, and they no longer return a streaming boundary. Use BIO_new_CMS() or BIO_new_PKCS7() to stream CMS and PKCS#7 content.

• Deprecated X509_check_host(), X509_check_email(), X509_check_ip(), and X509_check_ip_asc() functions. Applications should migrate to setting a reference identifier to check using X509_VERIFY_PARAM_set1_host(), X509_VERIFY_PARAM_set1_email(), or X509_VERIFY_PARAM_set1_ip_asc(), and using X509_verify_cert().

• Dropped Windows-on-Itanium (VC-WIN64I) and Windows CE (VC-CE) targets from Configurations.

• Dropped no-ecdsa and no-ecdh options from Configure, as these options did not really disable the implementations. Use no-ec to disable the elliptic curve support.

[Bruce Dubbs]

Fixed at commit 1d35fac7f.