Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
OpenSSL 1.1.1, announced on 11 September 2018, brought TLS 1.3 to the widely used cryptographic library, alongside changes to random-number generation, algorithm support and side-channel protections. It was a major release at the time, but the 1.1.1 series reached end of life on 11 September 2023; it should not be treated as a currently supported release.
What was new in OpenSSL 1.1.1?
OpenSSL Corporation announced version 1.1.1 on 11 September 2018. The announcement called it a new Long Term Support release and committed to supporting it for at least five years. Matt Caswell, the announcement’s author, summed up the main change: “The headline new feature is TLSv1.3.” OpenSSL’s 2018 release announcement also reported nearly 5,000 commits from more than 200 individual contributors since OpenSSL 1.1.0; those are rounded figures from the project, not an audited count.
The headline mattered because TLS is the protocol used to secure many network connections. TLS 1.3 changed the connection handshake and reduced the round trips needed to establish a connection. OpenSSL said that, in certain circumstances, a client could send encrypted data without first waiting for a round trip. That is a protocol capability, not a guarantee that every connection is faster: the announcement provides no numerical performance benchmark, and early data is not appropriate in every situation.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Did OpenSSL 1.1.1 add TLS 1.3?
Yes. OpenSSL 1.1.1 implemented TLS 1.3 and included a broad set of related features described in the OpenSSL 1.1.1 series release notes.
#1 Best Overall
- Early data (0-RTT): lets a client send data early in certain circumstances, without waiting for a round trip. It is an option, not a universal shortcut or a guarantee that early data is suitable for a given application.
- Post-handshake features: support for post-handshake authentication and key updates.
- Pre-shared keys (PSKs): support for TLS 1.3 PSKs, which can be used in the protocol’s authentication and connection-establishment mechanisms.
- Middlebox compatibility mode: a mode intended to help with network equipment that might otherwise mishandle aspects of the newer handshake.
- Cipher suites and tickets: support for all five cipher suites defined by RFC 8446 and configurable session tickets.
- Server support and implementation changes: stateless server support, plus rewrites to packet construction and extension handling.
- Signature algorithms: RSA-PSS support, which the series notes also say was backported for TLS 1.2.
These are protocol and library capabilities. Their availability to an application depends on how it uses OpenSSL and on the surrounding software and configuration.
What security and cryptographic changes came with 1.1.1?
OpenSSL 1.1.1 replaced the default random-number-generation method with an AES-CTR DRBG aligned with NIST SP 800-90Ar1. The release also added multiple DRBG instances with seed chaining, public and private instances, fork safety and per-thread instances. Random-number generation is foundational to cryptographic operations, so changes here were among the release’s substantial implementation updates.
The release announcement and series notes also highlighted side-channel security improvements. Side-channel protections address information that can leak through an implementation’s behavior, rather than changing a protocol’s advertised features alone. The materials identify improvements but do not quantify their effect across particular applications or hardware.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsNew algorithm and utility support included:
- SHA-3, SHA-512/224 and SHA-512/256.
- EdDSA, including Ed25519 and Ed448, and X448.
- Multi-prime RSA, SM2, SM3 and SM4.
- SipHash and ARIA.
- A URI-based STORE module.
Was OpenSSL 1.1.1 compatible with applications written for 1.1.0?
OpenSSL described 1.1.1 as API- and ABI-compliant with 1.1.0 and said most applications written for 1.1.0 could use the new library. It also cautioned that TLS 1.3 differs from TLS 1.2 and could affect a minority of applications. That release-era compatibility statement is not a guarantee for every program, operating-system package or deployment: applications may rely on particular TLS behavior, configuration or packaging choices.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Is OpenSSL 1.1.1 still supported?
No. OpenSSL announced that the 1.1.1 series reached end of life on 11 September 2023. The project’s EOL notice, published 15 June 2023, is the relevant lifecycle reference. The five-year support commitment in the 2018 announcement was historical; it does not mean the series remains supported today.
If you manage a system that still reports OpenSSL 1.1.1, check the operating system or software vendor’s package and security-update status before deciding what to do. The upstream end-of-life date does not, by itself, establish whether a particular vendor maintains a patched package or what migration path it supports.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
