{"slug": "openssl", "name": "OpenSSL", "category": "dev-libs", "category_name": "Libraries and frameworks", "description": "", "recommenders": 1, "commenters": 7, "warners": 2, "score": 0.345, "rising": 1.0, "first": "2025-12-13", "latest": "2026-10-23", "why": "Use an SSL client, e.g., openssl s_client, bssl client, etc.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 1, "neutral": 4, "compare": 0, "warn": 2}, "spark": [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0], "listed": false, "loved": [], "caveat": "", "short_quote": "Use an SSL client, e.g., openssl s_client, bssl client, etc.", "icon": false, "domain": null, "github_repo": "github.com/openssl/openssl", "official_url": "https://github.com/openssl/openssl", "pricing": "", "aliases": ["OpenSSL"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 796420833, "item_id": 49776302, "url": "https://news.ycombinator.com/item?id=49776302", "by": "1vuio0pswjnm7", "date": "2026-09-20", "stance": "recommend", "quote": "Use an SSL client, e.g., openssl s_client, bssl client, etc.", "excerpt": "That superuser thread from 2018 (it's ECH now not ESNI) isn't much help Although I do like the comment at the bottom that states the problem as disabling SNI not encrypting it. Encrypting SNI/ClientHello is over complicated, which is why ESNI was flawed and (allegedly) why Cloudflare disabled it. The solution to the plaintext SNI problem is to not send SNI (I don't send it unless necessary) There is an alternative no", "context": "", "use_case": "connecting without sending SNI", "switched_from": "", "story": "Spain orders blocks on Archive.today and its mirrors"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 790108163, "item_id": 49381760, "url": "https://news.ycombinator.com/item?id=49381760", "by": "maria7676", "date": "2026-08-20", "stance": "warn", "quote": "dont uses OpenSSL to prevent Future cves like heartBleed", "excerpt": "Fast and modern web application firewall made in Rust, uses vectorscan for match rules, have geolocation for IP addrnin logs, automatons, have reDoS protection, and dont uses OpenSSL to prevent Future cves like heartBleed, instead uses rustls... Have frontend with 2fa,auth,plots,acl log view, rules management... https://github.com/Orangewarrior/KrakenWaf", "context": "", "use_case": "TLS", "switched_from": "", "story": "KrakenWAF"}, {"id": 740050865, "item_id": 46253179, "url": "https://news.ycombinator.com/item?id=46253179", "by": "larusso", "date": "2025-12-13", "stance": "warn", "quote": "The switch to a newer open ssl version on Debian/Ubuntu created some issues for my tool.", "excerpt": "I think this is true for nearly all compiled languages. I had the same fun with rust and openSSL and glibC. OP didn\u2019t mentioned the fun with glib-c when compiling on a fairly recent distro and trying it to run on an older one. There is the \u201cmany Linux\u201d project which provides docker images with a minimum glib c version installed so it\u2019s compatible with newer ones. The switch to a newer open ssl version on Debian/Ubunt", "context": "", "use_case": "TLS in Rust tool", "switched_from": "", "story": "Go is portable, until it isn't"}]}], "who": [], "tags": [], "use_cases": ["certificate verification", "connecting without sending sni", "tls and secure memory", "tls", "encryption", "tls in rust tool"], "compared": [{"slug": "rustls", "name": "rustls", "co": 4, "switched_from": 0, "switched_to": 1}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=50208099", "title": "OpenSSL 4.1.0", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=50160877", "title": "Go will reject certificate chains containing eight distrusted SPKIs", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49772961", "title": "Spain orders blocks on Archive.today and its mirrors", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49590946", "title": "Signing TLS handshakes inside a TPM", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49381759", "title": "KrakenWAF", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47072863", "title": "Show HN: An encrypted, local, cross-platform journaling app", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {"warn": 1}, "2026-01": {}, "2026-02": {"neutral": 1}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {}, "2026-08": {"warn": 1}, "2026-09": {"neutral": 1, "recommend": 1}, "2026-10": {"neutral": 2}}, "quotes": [{"id": 803366848, "item_id": 50210428, "url": "https://news.ycombinator.com/item?id=50210428", "by": "adzm", "date": "2026-10-23", "stance": "neutral", "quote": "I think this is the only software project I use that still requires me to have perl", "excerpt": "I think this is the only software project I use that still requires me to have perl", "context": "", "use_case": "", "switched_from": "", "story": "OpenSSL 4.1.0"}, {"id": 802648035, "item_id": 50165502, "url": "https://news.ycombinator.com/item?id=50165502", "by": "agwa", "date": "2026-10-20", "stance": "neutral", "quote": "Hopefully OpenSSL will have a patch soon as well.", "excerpt": "Other certificate verifiers are doing the same: Node: https://github.com/nodejs/node/pull/66871 rustls/webpki: https://github.com/rustls/webpki/pull/546 Electron: https://github.com/electron/electron/pull/55126 This is very serious and you should definitely upgrade. Hopefully OpenSSL will have a patch soon as well.", "context": "", "use_case": "certificate verification", "switched_from": "", "story": "Go will reject certificate chains containing eight distrusted SPKIs"}, {"id": 796420833, "item_id": 49776302, "url": "https://news.ycombinator.com/item?id=49776302", "by": "1vuio0pswjnm7", "date": "2026-09-20", "stance": "recommend", "quote": "Use an SSL client, e.g., openssl s_client, bssl client, etc.", "excerpt": "That superuser thread from 2018 (it's ECH now not ESNI) isn't much help Although I do like the comment at the bottom that states the problem as disabling SNI not encrypting it. Encrypting SNI/ClientHello is over complicated, which is why ESNI was flawed and (allegedly) why Cloudflare disabled it. The solution to the plaintext SNI problem is to not send SNI (I don't send it unless necessary) There is an alternative no", "context": "", "use_case": "connecting without sending SNI", "switched_from": "", "story": "Spain orders blocks on Archive.today and its mirrors"}, {"id": 793523872, "item_id": 49595242, "url": "https://news.ycombinator.com/item?id=49595242", "by": "yusufmotiwala", "date": "2026-09-07", "stance": "neutral", "quote": "We faced a similar issue (we use OpenSSL).", "excerpt": "Isn't this a well-discussed issue already, and not specific to TPM? We faced a similar issue (we use OpenSSL). OpenSSL does have OPENSSL_secure_malloc() which prevents sensitive memory from being dumped. However, the problem is that not all paths use the secure allocator. For example, this issue: https://github.com/openssl/openssl/issues/27603 Not sure if this has changed in OpenSSL 4.x, but it is certainly something", "context": "", "use_case": "TLS and secure memory", "switched_from": "", "story": "Signing TLS handshakes inside a TPM"}, {"id": 790108163, "item_id": 49381760, "url": "https://news.ycombinator.com/item?id=49381760", "by": "maria7676", "date": "2026-08-20", "stance": "warn", "quote": "dont uses OpenSSL to prevent Future cves like heartBleed", "excerpt": "Fast and modern web application firewall made in Rust, uses vectorscan for match rules, have geolocation for IP addrnin logs, automatons, have reDoS protection, and dont uses OpenSSL to prevent Future cves like heartBleed, instead uses rustls... Have frontend with 2fa,auth,plots,acl log view, rules management... https://github.com/Orangewarrior/KrakenWaf", "context": "", "use_case": "TLS", "switched_from": "", "story": "KrakenWAF"}, {"id": 753346017, "item_id": 47084126, "url": "https://news.ycombinator.com/item?id=47084126", "by": "nola-a", "date": "2026-02-19", "stance": "neutral", "quote": "it only needs a few lines of Bash using OpenSSL.", "excerpt": "I use my jump project \u2014 it only needs a few lines of Bash using OpenSSL. https://github.com/nolasoft/jump", "context": "", "use_case": "encryption", "switched_from": "", "story": "Show HN: An encrypted, local, cross-platform journaling app"}, {"id": 740050865, "item_id": 46253179, "url": "https://news.ycombinator.com/item?id=46253179", "by": "larusso", "date": "2025-12-13", "stance": "warn", "quote": "The switch to a newer open ssl version on Debian/Ubuntu created some issues for my tool.", "excerpt": "I think this is true for nearly all compiled languages. I had the same fun with rust and openSSL and glibC. OP didn\u2019t mentioned the fun with glib-c when compiling on a fairly recent distro and trying it to run on an older one. There is the \u201cmany Linux\u201d project which provides docker images with a minimum glib c version installed so it\u2019s compatible with newer ones. The switch to a newer open ssl version on Debian/Ubunt", "context": "", "use_case": "TLS in Rust tool", "switched_from": "", "story": "Go is portable, until it isn't"}]}