OpenSSL 1.1.1 End of Life on September 11, 2023

[yhirose]

[yhirose]

https://www.openssl.org/policies/releasestrat.html

[stingray-11]

Note that the README says only OpenSSL 1.1.1 and 3.0 are supported, but 3.1 seems to work fine at least with cpp-httplib 0.12.6 on Linux. I have not tried Windows. OpenSSL has gotten better about semantic versioning and I don't think 3.1 removes anything. It shows up as the same "libssl.so.3".

Arch Linux is now shipping OpenSSL 3.1 so it might be a good time to make support for it official.

[vitaly-castLabs]

I'm curious about the reasoning behind the "fix". Are there any known critical vulnerabilities making 1.1.1 unusable? What about BoringSSL presenting itself as OpenSSL 1.1.1: https://boringssl.googlesource.com/boringssl/+/refs/heads/master/include/openssl/base.h#101

Imo dropping 1.1.1 support is a very ill-conceived development considering the fact 3.x and 1.1.1 APIs are virtually identical

[sum01]

@vitaly-castLabs Isn't v1.1.1 EOL? Seems logical to me to move away from it before someone finds an exploit for software that won't be patched.

[vitaly-castLabs]

@sum01 it's sorta EoL, but the reality is a) even 1.0.2 is still being patched for paying OpenSSL customers; b) you might find yourself in a situation where people are using your cpp-httplib-based code on a slightly outdated distro or environment with only 1.1 available.
The whole thing is just a self-inflicted pain in the back for the sake of being "secure" imo.