OpenSSL 4.1.0 ships DTLS 1.3 support, along with a published bug list
OpenSSL 4.1.0 is out, and the headline feature is one a lot of people have been waiting for: full DTLS 1.3 support. But read the release notes before you upgrade, because this build ships with four known issues. All of them live in the new DTLS implementation.
The release landed on the OpenSSL GitHub page on today, pushed by the automated openssl-machine bot. It's a feature (minor) release, so it sits on the OpenSSL 4.0 ABI and stays API- and ABI-compatible with it. Your apps that already link against 4.0 can generally pick up 4.1 without recompiling. That's the whole point of the versioning scheme they switched to back with 3.0.
The timeline here is worth a glance. OpenSSL ran through a 4.1.0-alpha1 in September, then shipped 4.1.0-beta2 on October 9 as the actual release. Yes, a beta. That was because of two security problems in the new DTLS-1.3 code (issues #33172 and #33173), and the maintainers clearly didn't want to ship 4.1.0 with a hole in it. They held the final tag until October 23. The beta issues appear to have been patched before the tag, though the release notes still list four separate DTLS bugs. Every vendor should publish a bug list like that. Most don't.
What DTLS 1.3 actually gets you
DTLS 1.3 (RFC 9147) is TLS 1.3 running over datagram transports like UDP instead of connection-oriented TCP. It matters for anything that can't afford latency, so real-time gaming, some VoIP, and a few streaming protocols. The Supported Versions extension now advertises DTLS 1.3 with the value 0xFEFD, and the handshake gained explicit Acknowledgement messages to cut down on needless retransmissions over lossy links.
OpenSSL also rewrote the listener API. The new SSL_new_listener() handles DTLS 1.3 with HelloRetryRequest cookie validation, a meaningful upgrade over the old DTLSv1_listen() that only knew DTLS 1.0 and 1.2. You can tune the maximum pending connections (default 256), the pending timeout (default 30000 ms), and the max datagram size (default 2000 bytes).
There are gaps, though, and you should know about them before building on DTLS 1.3. OpenSSL doesn't support Connection IDs at all, so it ignores them. A DTLS 1.3-over-SCTP client gets downgraded to 1.2 or 1.0 by an OpenSSL server. And one cipher suite, TLS_AES_128_CCM_8_SHA256, is unusable under DTLS because its short auth tag needs safeguards OpenSSL doesn't implement for this transport. It still works fine for plain TLS.
That last one is the kind of thing that bites people months later. If your stack leans on that CCM_8 suite over UDP, this build won't hand it to you.
A quieter story: post-quantum speed
The other thread running through 4.1 is post-quantum crypto. The ML-DSA and ML-KEM algorithms are already in the EVP API, but this release adds optimized paths: NTT operations for ppc64le, ML-DSA work for x86_64, AVX-512-accelerated SHAKE x4 operations, and VAES tweaks for AES-CBC decryption. PQC primitives are heavy, and these make them not hurt quite so much when they run. For reference, ML-KEM requires TLS 1.3, and SLH-DSA signature blobs run anywhere from roughly 8 to 50 KB depending on the variant. So speed matters.
Also new here: RFC 8701 GREASE support, an IKEv2 KDF implementation for IPsec work, and initial support for the Russian Elbrus2000 (e2k) architecture. None of it will make headlines, but each is genuinely useful to the right crowd.
Before you upgrade
A few things will actually slow you down if you're moving from 4.0. OpenSSL dropped the Windows-on-Itanium (VC-WIN64I) and Windows CE (VC-CE) build targets. On the flip side, it added MSVC 2013 build targets (VC-WIN32-MSVC2013 and VC-WIN64A-MSVC2013) for people still on older Windows toolchains. That's a strange pairing of old and new in the same release, but it's there if you need it.
If you use the tsget timestamping tool, install Net::Curl::Easy before you upgrade. It switched away from the abandoned WWW::Curl::Easy, and tsget will just fail otherwise. They also removed the no-ecdsa and no-ecdh configure options because neither actually disabled anything. Use no-ec instead.
A couple of people touching low-level EVP or ASN1 code will want the migration guide. EVP_CIPHER_CTX_get_num() and set_num() are deprecated, mostly because they existed for engines, which 4.0 deleted anyway. ASN1_BIT_STRING_set() gives way to the safer set1() variant, which also validates arguments. A couple of other calls quietly became no-ops.
Keep in mind that the master branch is currently 438 commits ahead of this tag, so there's clearly still a lot moving under the hood.
The verdict
It's arguably the most feature-packed 4.x line OpenSSL has put out, but the documented DTLS bugs mean you should test before rolling it out somewhere that matters. Evaluate it against your actual workload, especially if you run listener-based multi-client UDP servers.
You can grab the release from the OpenSSL GitHub page, and read the full release notes, the migration guide, and the DTLS 1.3 manual page (ossl-guide-dtlsv13(7)) on the OpenSSL website.
