OpenSSL's Journey: Technical Updates Governance and Community
summary
Project governance tightens around an eight-person core team (six engineers) with a new mission and public roadmap; releases move to a time-based April/October cadence. 3.1 ships FIPS 140-3 targeting and invasive library-context locking fixes that improve multithreaded performance; 3.2 is feature-complete for QUIC support (client-first, server expected later), adds Argon2 and certificate compression, and exposes stream APIs like SSL_new_stream and SSL_accept_stream. CI runs hundreds of GitHub and internal jobs plus Coverity, fuzzing, ASAN/TSAN; FIPS validation may take about a year.
AI-written summary · about
chapters (14)
- 0:00OpenSSL’s journey
- 2:28Governance structure
- 5:41Mission and values
- 7:10Community outreach
- 9:23OpenSSL 3.1 updates
- 13:08FIPS 140-3 status
- 13:49OpenSSL 3.2 and QUIC
- 18:06Services and growth
- 21:44Testing and CI
- 23:19FIPS mode differences
- 25:31Extended support
- 26:57Security practices
- 29:52Future plans and QUIC
- 31:19Transparency push
related talks
32mPQC in OpenSSL Library
08mIntroducing QuicTLS
59mSecurity in the Open: OSS and AWS
01h 02mNIST Post-Quantum Cryptography Update
29mOpen Source Contribution - How does it even work?
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
38mKeynote: CNCF Project Update - Liz Rice, Colin Sullivan, Andrew Jessup, Sugu Sougoumarane
41mThe development of 'civil' cryptography. Releasing mobile app updates with FIPS-certified crypto