OpenSSL 4.1.0-alpha1 brings DTLS 1.3, GREASE, and post-quantum optimizations
The first alpha of the next major OpenSSL feature release adds the long-awaited DTLS 1.3 protocol, fixes protocol ossification issues, and pushes harder on NIST's post-quantum algorithms.
Tomáš Mráz announced OpenSSL 4.1.0-alpha1 today. It sits on top of the security-hardened 4.0.2 foundation released in August. The 4.x line is now the active feature development branch. This alpha is where the team is dumping significant new functionality after the API shakeup of 4.0.
Keep in mind that OpenSSL 4.0 was already a major departure. It broke the API, added LMS signatures, Chinese crypto standards (SM2/SM3/SM4), Encrypted Client Hello, and hybrid post-quantum groups like X25519MLKEM768. The 4.0 line has been getting steady security patches. 4.0.1 landed in June, and 4.0.2 followed in August. This alpha is the first look at what comes next.
DTLS 1.3 finally arrives
The biggest addition is full DTLS 1.3 support per RFC 9147. OpenSSL supported DTLS 1.0 and 1.2 for years, but 1.3 was nowhere to be found until now.
You get the TLS 1.3-style handshake for datagram transport, which means faster handshakes, modern cipher suites, and post-quantum key exchange over UDP. That is likely the part of the changelog you'll be reading first if you run WebRTC stacks or QUIC servers.
DTLS 1.2 also gets Ed25519 and Ed448 support now, closing a long-standing gap where those algorithms only worked for TLS. The implementation includes improved handshake robustness under UDP packet reordering via buffering of early ChangeCipherSpec records. There's a new ossl-guide-dtlsv13(7) manual page if you need the gory details.
GREASE and listener API updates
OpenSSL is finally adding GREASE support. RFC 8701 isn't exactly new, but the implementation was lagging. Set SSL_OP_GREASE to inject reserved values into cipher suites, supported versions, and extensions. There's a new -grease flag for openssl s_client as well.
This prevents protocol ossification, where middleboxes and proxies silently drop anything they don't recognize. If your app routes through a lot of corporate firewalls, you'll want to enable this.
The SSL_new_listener API gets an upgrade to handle DTLS, not just QUIC. SSL_new_listener() can now create a DTLS listener that demultiplexes incoming datagrams into per-peer connections. That simplifies server-side code significantly. You get configurable limits for pending connections and datagram size, with address validation handled by default.
Other features and crypto changes
There are a few other additions worth scanning. EVP_KDF-IKEV2KDF adds the key derivation function used in IPsec/IKEv2, which might help unify crypto operations across TLS and IPsec tooling.
You also get initial support for the Elbrus2000 architecture. It's a Russian processor used in government and military systems. It expands OpenSSL's reach, though it does raise some supply chain questions depending on where your binary is going.
On the performance side, the post-quantum optimizations are getting more aggressive. ML-DSA NTT operations are now AVX2-optimized on x86_64, with an AVX-512 SHAKE x4 path that processes four SHAKE operations in parallel using 512-bit SIMD lanes. PowerPC (ppc64le) and s390x are getting ML-DSA and ML-KEM NTT operations too.
AES-CBC decryption jumped 3.5× to 3.8× faster via AVX-512 and VAES on x86_64. That is not post-quantum, but it is meaningful for general throughput.
Breaking changes and migration
If you are upgrading from 4.0.x, pay attention to the breaking changes.
The VC-WIN64I and VC-CE Windows targets are gone. The no-ecdsa and no-ecdh configure options have been dropped; use no-ec instead. If your build scripts rely on the old flags, they will break.
BIO_snprintf and BIO_vsnprintf are now deprecated. You should migrate to standard snprintf and vsnprintf. The deprecation is not a removal yet, but it is time to move on.
The TLS padding extension is gone. It was a workaround for an old F5 middlebox bug. It is not going to work on anything that matters anymore. SSL_OP_TLSEXT_PADDING is now a no-op.
There are also fixes that change behavior. Stale ALPN protocol retention affecting 0-RTT decisions is patched. Early data encryption using retired ticket secrets is fixed. On the X.509 side, the Subject DN is no longer consulted by default. SAN is now authoritative. You can opt back into CN matching with X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT.
The 16 MB stdin limit for Ed25519 signing on Unix is gone. Memory-mapped I/O handles large files now.
The build system picked up some niceties. There are new targets for MSVC 2013 with C99 bridging functions. AArch64 assembly now declares Guarded Control Stack compatibility for Clang 18+ and GCC 15+. Public headers are fully self-contained with proper guards. If you are on BSD, you can generate man pages in mdoc format now.
What's next
The final release date is not set. CHANGES.md still has [xx XXX xxxx] placeholders. This is a substantial alpha, but the OpenSSL team is still working on the 4.1 feature set.
Migration from 4.0.x requires a few checks. If you relied on specific EC point conversion forms in TLS 1.2, behavior differs. OpenSSL now accepts any decodable form regardless of the extension. You will also want to enable SSL_OP_GREASE if you have not already.
Head here to download the release from GitHub.
