OpenSSL

OpenSSL is a full-featured open source toolkit for the TLS, DTLS, and QUIC protocols, built on top of a general-purpose cryptographic library. It ships three deliverables: libcrypto (general-purpose crypto), libssl (TLS/DTLS/QUIC), and the openssl command-line program. The codebase has been in continuous development since 1998 (descended from SSLeay) and is licensed under Apache 2.0.

What this wiki covers

This wiki is a reverse-engineered tour of the source tree at master (4.1-dev). The intent is to help a new contributor or integrator answer four kinds of questions:

• "Where is the code that does X?" — see architecture, libraries, features.
• "How do I build, run, and debug it?" — see getting-started, how-to-contribute/debugging.
• "What is a provider / OSSL_PARAM / EVP_PKEY?" — see glossary, subsystems/core-and-libctx, subsystems/evp.
• "Why is the code organized this way?" — see background/migration-3x, background/design-decisions.

What ships in the toolkit

Deliverable	Source root	One-liner
libcrypto	crypto/, providers/	The general-purpose crypto library: ASN.1, X.509, BIGNUM, EVP, BIO, RAND, PKI, providers, …
libssl	ssl/	TLS 1.0–1.3, DTLS 1.0–1.2, QUIC v1 client and server
openssl CLI	apps/	A swiss-army knife for crypto: genpkey, req, x509, s_client, s_server, cms, cmp, speed, …
FIPS provider	providers/fips/	A separately-built shared module (fips.so / fips.dll) suitable for FIPS 140 validation
Demos	demos/	Self-contained example programs (TLS, QUIC, CMS, KDFs, …)
Manual pages	doc/man[1357]/	913 POD pages — the canonical API reference

Reading order for newcomers

1. overview/architecture — the libcrypto/libssl/provider model in one diagram.
2. overview/getting-started — clone, configure, build, test in 10 minutes.
3. libraries/openssl-cli — the openssl command, the most accessible entry point.
4. subsystems/evp — the algorithm-agnostic API every modern caller uses.
5. subsystems/core-and-libctx — how libcrypto finds an algorithm implementation.
6. Pick a feature page that matches your interest: TLS, QUIC, X.509 PKI, post-quantum.

Project facts

• Language mix: ~894k lines of C across crypto/, ssl/, providers/, apps/, test/, plus ~272k lines of Perl (asm generators, build glue, test helpers) and ~913 POD man pages.
• Build system: Perl-driven Configure + build.info files → generated Makefile. See reference/build-system.
• Repository age: ~28 years of history (oldest commit 1998-12-21, "Import of old SSLeay release: SSLeay 0.8.1b").
• Active maintainers (recent): Pauli, Eugene Syromiatnikov, Neil Horman, Bob Beck, Dr. David von Oheimb, Matt Caswell, Tomas Mraz, and others. See maintainers.
• Versioning: Major.Minor.Patch defined in VERSION.dat; master is currently 4.1-dev.

Where to read code, design notes, and API docs

Need	Look at
Public C API	include/openssl/*.h (and .h.in templates)
Internal C API	include/internal/*.h, include/crypto/*.h
Algorithm implementations	providers/implementations/{ciphers,digests,kdfs,kem,signature,…}/
TLS/DTLS handshake	ssl/statem/, ssl/record/
QUIC	ssl/quic/
X.509, CMS, PKCS#7/12, OCSP, CMP, TS	crypto/{x509,cms,pkcs7,pkcs12,ocsp,cmp,ts}/
Architecture / RFC-style design notes	doc/designs/ (ECH, ML-KEM, ML-DSA, QUIC, FIPS indicators, …)
Manual pages	doc/man1/ (CLI), doc/man3/ (API), doc/man5/ (config), doc/man7/ (concepts/guide)
Tests	test/*.c (unit/integration), test/recipes/*.t (Perl harnesses)
CI	.github/workflows/ (32 workflows)

License

Apache License 2.0. See LICENSE.txt. Copyright is held by "The OpenSSL Project Authors" with an additional notice for the original SSLeay authors (Eric A. Young, Tim J. Hudson).