OpenSSL

OpenSSL originated in 1998 as a fork of SSLeay, a library developed by Eric Young and Tim Hudson, after the original project ceased active maintenance. The name reflects the goal of providing an open-source implementation of SSL and TLS. The project is governed by a core team of developers and is funded through donations and commercial support from organizations like the OpenSSL Foundation and the OpenSSL Software Services. Over the years, it has undergone significant evolution, with the 1.0.0 release in 2010 introducing a more stable API, and the 1.1.0 release in 2016 adding TLS 1.3 support. The 3.0 release in 2021 marked a major architectural shift, introducing a provider-based model for cryptographic algorithms, allowing for more flexible and secure configuration.

OpenSSL provides a comprehensive set of cryptographic functions, including symmetric and asymmetric encryption, hash functions, digital signatures, and certificate management. Its command-line tool, openssl, is widely used for tasks such as generating RSA or ECDSA key pairs, creating Certificate Signing Requests (CSRs), and inspecting certificates. The library is embedded in many popular software packages, including Apache HTTP Server, nginx, and PostgreSQL, and it is the default TLS library for many Linux distributions. Developers use its API to integrate TLS into applications, with support for multiple protocols and cipher suites. The library also includes a robust random number generator and utilities for testing TLS connections, such as s_client and s_server.

OpenSSL has been the subject of several high-profile security vulnerabilities, most notably Heartbleed (CVE-2014-0160), disclosed in April 2014. Heartbleed allowed attackers to read sensitive memory from servers running vulnerable versions, exposing private keys and user data. The incident prompted a massive internet-wide patching effort and led to a major audit of the codebase. Other significant vulnerabilities include POODLE (CVE-2014-3566) and the 2016 DROWN attack (CVE-2016-0800). These events have driven improvements in the project's security practices, including more rigorous code review, fuzzing, and the establishment of a security policy. The project also introduced a bug bounty program to encourage responsible disclosure.

Beyond its mainstream use, OpenSSL has several niche features and historical quirks. It includes support for the older SSLv2 and SSLv3 protocols, though these are disabled by default due to security concerns. The library also provides a low-level API for direct access to cryptographic primitives, used by researchers and specialized applications. OpenSSL's FIPS (Federal Information Processing Standards) module, validated by NIST, allows government and regulated industries to use the library in compliance with standards. The project has a long-standing tradition of naming releases after historical figures, such as 'OpenSSL 1.0.2h' and 'OpenSSL 3.0.0', though this practice was discontinued. Additionally, the command-line tool includes a s_time utility for benchmarking TLS performance, and a cms command for Cryptographic Message Syntax operations, which are less commonly known.

TLS

Transport Layer Security, a cryptographic protocol for secure communication over a network.

SSL

Secure Sockets Layer, the predecessor to TLS, now deprecated.

Heartbleed

A critical vulnerability in OpenSSL's Heartbeat extension, allowing memory disclosure.

FIPS

Federal Information Processing Standards, a set of U.S. government standards for cryptography.