OpenSSL 4.1.0 Released, Introducing DTLS 1.3, Post-Quantum Cryptography, and Expanded Capabilities Published on October 23, 2026, this update includes compatibility changes and addresses four known DTLS issues for developers This article explores dtls support ssl. . The post-quantum improvements focus on accelerating ML-DSA and ML-KEM operations without introducing these algorithms for the first time.
Based on TLS 1.3, DTLS secures datagram communications against eavesdropping, tampering, and message forgery while preserving the underlying transport's datagram semantics.
OpenSSL instructs developers to consult the ossl-guide-dtlsv13(7) manual for implementation details and adds DTLS support to its SSL listener API. Additional features include RFC 8701 GREASE (Generate Random Extensions And Sustain Extensibility), IKEv2 key derivation function support, and Elbrus2000 architecture initial support. Maintainers seeking to disable elliptic-curve support must now use no-ec.
Separately, tsget now requires Net::Curl::Easy from the Net-Curl CPAN distribution, replacing the abandoned WWW::Curl::Easy dependency.
Issue #33278 can misclassify a retryable nonblocking write failure as SSL_ERROR_SYSCALL rather than SSL_ERROR_WANT_WRITE, potentially prompting applications to close usable connections. Finally, issue #33242 can cause unexpected_message handshake failures when clients acknowledge the server's first flight without waiting for a response, including after packet loss. Upgrade testing should also cover removed configuration options, legacy Windows build requirements, and the tsget dependency change before production rollout, especially where existing automation assumes previous behavior.
