OpenSSL 4.1.0 arrives with DTLS 1.3, GREASE and IKEv2 KDF alongside incompatible changes

What shipped

The OpenSSL project has published version 4.1.0, a feature release that, according to the release notes on GitHub, adds significant new functionality to the library. The announcement, which drew attention on the Hacker News front page, also lists changes the project itself flags as potentially significant or incompatible, plus a set of known issues worth reading before deployment.

The incompatible changes

Three items stand out for anyone maintaining builds or packages:

• The tsget timestamping utility now uses Net::Curl::Easy from the Net-Curl CPAN distribution instead of the abandoned WWW::Curl::Easy. The release notes advise anyone relying on tsget to install the new dependency before upgrading.
• The Windows-on-Itanium (VC-WIN64I) and Windows CE (VC-CE) build targets have been removed from the configuration system.
• The no-ecdsa and no-ecdh Configure options are gone. According to the project, these options never actually disabled the underlying implementations; anyone who genuinely wants elliptic-curve support switched off should use no-ec instead.

On the additions side, new VC-WIN32-MSVC2013 and VC-WIN64A-MSVC2013 build targets provide internal functions that bridge gaps in C99 standard support present in MSVC 2013.

Optimizations for modern cryptography primitives

The release lands a batch of performance work. ML-DSA and ML-KEM number-theoretic transform operations are optimized on ppc64le, ML-DSA operations are optimized on x86_64, and ML-DSA on x86_64 additionally gains AVX-512-optimized SHAKE x4 operations. AES-CBC decryption on x86_64 picks up AVX-512 and VAES optimizations. ML-DSA and ML-KEM are the lattice-based signature and key-encapsulation schemes associated with post-quantum cryptography, so faster implementations matter for anyone running hybrid or PQC deployments.

New features

Four additions headline the feature list, alongside initial support for the Elbrus2000 (e2k) architecture:

• DTLS 1.3 support as defined in RFC 9147, bringing the datagram-transport variant of TLS to the 1.3 generation, with details in the ossl-guide-dtlsv13(7) manual page.
• Support for RFC 8701 GREASE (Generate Random Extensions And Sustain Extensibility).
• DTLS support in the SSL listener API.
• An IKEv2 key derivation function.

Known issues cluster around DTLS

The release notes track four open issues, and all of them sit in DTLS code paths that are new or newly expanded in this release:

• Issue #32878: when a DTLS 1.3 KeyUpdate arrives, all other outstanding post-handshake records are dropped from the retransmission buffer. A record still awaiting an ACK, such as a NewSessionTicket, will therefore not be retransmitted if the original transmission is lost. A fix is in progress and planned for a future release.
• Issue #33277: a permanent receive failure on a DTLS listener can be reported as SSL_ERROR_WANT_READ on an accepted connection. Polling and subsequent accept calls may also fail to report the error, causing applications to continue waiting after a permanent failure.
• Issue #33278: a retryable write failure on a nonblocking connection accepted from a DTLS listener can be reported as SSL_ERROR_SYSCALL instead of SSL_ERROR_WANT_WRITE. Applications that treat that result as fatal may close a connection that is still usable.
• Issue #33242: DTLS 1.3 servers may abort handshakes with an unexpected_message alert when a client acknowledges part or all of the server's first flight before sending its response. This can occur after packet loss or while the client prepares its authentication response.

Why it matters

OpenSSL remains one of the most widely deployed cryptography libraries in the world, so even minor incompatible changes ripple outward through Linux distributions, language bindings, container images and appliances. This release carries three practical warnings. Packaging that ships tsget needs a new Perl dependency before upgrade day. Build scripts that reference the removed Configure options or the dropped Windows targets will need updating. And the headline feature, DTLS 1.3, ships with known rough edges: all four tracked issues live in that area, including handshake aborts and misreported error codes that could prompt applications to close healthy connections. Operators planning early DTLS 1.3 adoption should test against these specific failure modes; everyone else should read the changelog closely before rolling 4.1.0 into production.