Repository navigation
Add OpenSSL 3.5 support to CPython infrastructure #132339
Description
On April 8th, 2025 OpenSSL 3.5 was released, the latest OpenSSL LTS: https://openssl-library.org/post/2025-04-08-openssl-35-final-release/
Here is a table of the OpenSSL release roadmap and deprecation schedule from1:
| Version | Release Type | Release Date | Supported Until |
|---|---|---|---|
| 3.0 | LTS | Sep 2021 | Sep 2026 |
| 3.1 | Non-LTS | Mar 2023 | Mar 2025 |
| 3.2 | Non-LTS | Nov 2023 | Nov 2025 |
| 3.3 | Non-LTS | Apr 2024 | Apr 2026 |
| 3.4 | Non-LTS | Oct 2024 | Oct 2026 |
| 3.5 | LTS | Apr 2025 | Apr 2030 |
| 3.6 | Non-LTS | Oct 2025 | Nov 2026 |
| 4.0 | Non-LTS | Apr 2026 | May 2027 |
OpenSSL 3.5 is the only version with free public support beyond 2026, and lining up this with the Python release schedules, it looks like ideally 3.11—3.14 would all support OpenSSL 3.5 to overlap the OpenSSL window. I haven't assessed how complicated the internal changes, but wanted to start the process based on the discussion in #131423.
Linked PRs
- gh-132339: Add support for OpenSSL 3.5 #137720
- [3.14] gh-132339: Add support for OpenSSL 3.5 (GH-137720) #137747
- gh-132339: Update macOS installer version of OpenSSL to 3.5.4. #140075
Activity
scw commentedon Apr 11, 2025
For what it's worth, I was able to use the build installer script to build
_hashlib.cpython-314-darwin.soand_ssl.cpython-314-darwin.so, but didn't engage in any comprehensive testing of their correctness.guymaidoc commentedon May 29, 2025
Another motivation to upgrade - openSSL fixed performance issues in windows in 3.4.1, which according to my tests, have high impact
Edward-Knight commentedon Aug 13, 2025
Do we know if CPython is compatible with OpenSSL 3.5 and just doesn't have the build magic, or if work is required to make it compatible? Or is this an unknown? I know that previous updates took some work (see #83001).
I'm interested in getting this added to astral-sh/python-build-standalone, but wanted to check what the state of play is upstream.
@tiran, could you please provide some insight if possible 😇
zware commentedon Aug 13, 2025
Step 1 is to get 3.5 added to the existing multi-ssl CI testing, which should be straightforward to do and should give an indication of whether further work is required.
pythongh-132339: Add OpenSSL 3.5.2 definitions to Modules/_ssl_data_35.h
gh-132339: Add support for OpenSSL 3.5 (GH-137720)
[3.14] pythongh-132339: Add support for OpenSSL 3.5 (pythonGH-137720)
[3.14] gh-132339: Add support for OpenSSL 3.5 (GH-137720) (#137747)
pythongh-132339: Add support for OpenSSL 3.5 (pythonGH-137720)
Edward-Knight commentedon Aug 26, 2025
Thanks to @zware et al., we have full OpenSSL 3.5 support in CPython 3.14+ 🥳
Regarding the rest of this issue:
I agree, and would love to see full OpenSSL 3.5 support in versions earlier than 3.14, but it looks like the changes won't be backported: #127331 (comment)
However, it sounds like versions prior to 3.14 (3.13 in particular) will work (are compatible) if compiled with OpenSSL 3.5, but will be missing messages for the new error codes. Since this won't impact any major functionality I'm going to look at getting OpenSSL 3.5 into astral-sh/python-build-standalone for Python 3.11—3.14
Assuming nothing more is going to change in CPython, should we consider this issue closed?
[3.14] pythongh-132339: Add support for OpenSSL 3.5 (pythonGH-137720) (…
sethmlarson commentedon Sep 30, 2025
Indeed, let's close this issue due to: #127331 (comment)
pythongh-132339: Update macOS installer version of OpenSSL to 3.5.4.
gh-132339: Update macOS installer version of OpenSSL to 3.5.4. (#140075)
fix: add Python 3.13 + OpenSSL 3.5 compatibility and documentation im…