by 
OpenSSL 3.3 has been released today as a major update to this powerful, open-source, cross-platform, and free software library that provides secure communications over computer networks for applications and websites.
Coming four and a half months after OpenSSL 3.2, the OpenSSL 3.3 release brings support for QLog for tracing QUIC connections, along with limited support for polling of QUIC connections and stream objects in a non-blocking manner, as well as several new APIs to allow the configuration of various aspects for connections using the QUIC encrypted connection-oriented protocol that operates at the Transport Layer, or Layer 4, in the OSI model.
The new APIs allow users to configure the negotiated idle timeout for QUIC connections, determine the number of additional streams that can currently be created for a QUIC connection, disable implicit QUIC event processing for QUIC SSL objects, and query the size and utilization of the write buffer of a QUIC stream.
OpenSSL 3.3 also comes with a new SSL_write_ex2 API for sending an end-of-stream (FIN) condition in an optimized way when using QUIC, a new EVP_DigestSqueeze() API to allow SHAKE to squeeze multiple times with different output sizes, and new SSL_SESSION_get_time_ex() and SSL_SESSION_set_time_ex() API functions that use time_t, which is Y2038 safe on 32-bit systems when 64-bit time is enabled.
New -set_issuer and -set_subject options have been added as well to the openssl x509 command to let users override the “Issuer” and “Subject” when creating a certificate, and the old -subj option is an alias for the new -set_subject option.
Moreover, OpenSSL 3.3 introduces a new SSL_OP_PREFER_NO_DHE_KEX option to allow users to configure a TLS1.3 server to prefer session resumption using a PSK-only key exchange over PSK with DHE, when both are available, as well as a new X509_STORE_get1_objects API to avoid issues with the existing X509_STORE_get0_objects API in multi-threaded apps.
Other than that, the BLAKE2s hash algorithm has been updated in this release to match BLAKE2b’s support for configurable output length, the EVP_PKEY_fromdata function has been augmented to allow for the derivation of CRT (Chinese Remainder Theorem) parameters when requested, and a new atexit configuration switch has been added for controlling whether OPENSSL_cleanup is registered when libcrypto is unloaded.
Several new features of CMPv3 defined in RFC 9480 and RFC 9483 have been added as well in OpenSSL 3.3, which ships with an exporter for CMake on Unix and Windows systems alongside the pkg-config exporter, as well as support for ignoring unknown entries in the TLS SignatureAlgorithms and ClientSignatureAlgorithms configuration options and the respective calls to SSL[_CTX]_set1_sigalgs() and SSL[_CTX]_set1_client_sigalgs() that start with the ? character.
For more details, check out the release notes. Meanwhile, you can download OpenSSL 3.3 right now from the official website. All users, websites, and operating systems are recommended to upgrade to this release as soon as possible.
Last updated 3 weeks ago
