OpenSSL

OpenSSL is an open-source cryptographic software library that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a general‑purpose cryptographic toolkit. The library provides a robust, full‑featured set of cryptographic functions, including symmetric encryption, asymmetric encryption, digital signatures, hashing, and certificate management. It is widely used in web servers, client applications, and other networked software to secure communications over the Internet.

History
OpenSSL originated as a fork of the original SSLeay library, which was developed by Eric A. Young and Tim J. Krebs in the mid‑1990s. In December 2001, the OpenSSL Project was established to continue development after the original authors ceased work on SSLeay. The project released its first version, 0.9.4, in early 2002. Since then, the library has undergone numerous major releases, incorporating support for newer protocol versions (e.g., TLS 1.2, TLS 1.3) and enhancing its cryptographic algorithms.

Architecture and Components
The OpenSSL distribution consists of three primary components:

1. libcrypto – a general‑purpose cryptographic library offering implementations of algorithms such as AES, DES, RSA, DSA, ECDSA, SHA‑1/2/3, and others.
2. libssl – a protocol implementation that provides the SSL/TLS handshake, session management, and record layer functionality.
3. Command‑line utilities – tools such as openssl that allow users to perform cryptographic operations, generate keys and certificates, test TLS connections, and manage certificate authorities.

Licensing
OpenSSL is released under the Apache License 2.0, following the project's adoption of the Apache License in version 3.0 (released in 2015). The license permits free use, modification, and distribution, both in open‑source and proprietary software, subject to certain attribution and notice requirements.

Adoption and Use Cases
OpenSSL is incorporated into a broad range of software stacks, including:

• Web servers (e.g., Apache HTTP Server, Nginx) for HTTPS support.
• Email servers and clients for secure mail transfer (SMTP, POP3, IMAP) via STARTTLS.
• VPN solutions (e.g., OpenVPN) and other network appliances.
• Development frameworks and programming languages that expose OpenSSL bindings (e.g., Python’s ssl module, Ruby’s OpenSSL extension).

Security Incidents
The most notable vulnerability affecting OpenSSL was Heartbleed (CVE‑2014‑0160), disclosed in April 2014. The bug involved a missing bounds check in the TLS heartbeat extension, allowing an attacker to read up to 64 KB of memory from the process handling TLS connections. The vulnerability prompted widespread patching and a heightened emphasis on software supply‑chain security. Subsequent audits have identified and remedied other issues, such as the Padding Oracle attacks on early TLS 1.2 implementations.

Development and Governance
OpenSSL development is coordinated by the OpenSSL Software Foundation, a nonprofit organization that oversees contributions, releases, and funding. The project accepts contributions from individual developers and corporations, maintains a public Git repository, and follows an open governance model guided by a steering committee. Regular releases are announced on the project's official website and mailing lists, with security advisories issued as needed.

Compatibility and Alternatives
OpenSSL is compatible with major operating systems, including Linux, macOS, Windows, BSD variants, and embedded platforms. Alternative TLS/cryptographic libraries include GnuTLS, LibreSSL (a fork of OpenSSL created after the Heartbleed disclosure), BoringSSL (Google’s internal variant), and WolfSSL. While these alternatives provide similar functionality, OpenSSL remains the most widely deployed due to its extensive feature set and long‑standing presence in the software ecosystem.

References

• OpenSSL Project. “OpenSSL – Cryptography and SSL/TLS Toolkit.” https://www.openssl.org/
• “Heartbleed Bug.” CVE‑2014‑0160. MITRE. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE‑2014‑0160
• The Apache Software Foundation. “Apache License, Version 2.0.” https://www.apache.org/licenses/LICENSE-2.0

This entry presents a concise overview of OpenSSL based on publicly available, verifiable sources.