LBC Meeting Minutes Sept 8, 2026

Your Webex meeting content is available.

OpenSSL LBC Monthly Meeting

Host: Jeff Johnson

Tuesday, September 8, 2026

10:29 AM  |  (UTC-04:00) Eastern Time (US & Canada)  |  38 mins

Recording

Topic

Password

OpenSSL LBC Monthly Meeting-20260908 1508-1

rYfBFZ56

Meeting summary AI-generated

Key participants in this meeting included Jeff Johnson, Anton Arapov, Chris Ward, Kevin Micciche, Lutz Jänicke, Dan Wing, and Barry Fussell. The primary focus was on improving community engagement through a new lightweight request for guidance form designed to facilitate open discussions and feedback on OpenSSL issues, as explained by Jeff Johnson and supported by Anton Arapov and Kevin Micciche.

The team addressed the recent end of life of OpenSSL 3.0, with Anton Arapov emphasizing the need to understand client usage to guide ongoing commercial support. Jeff Johnson and Barry Fussell noted limited adoption of version 3.0, with many users moving to newer releases.

A significant portion of the discussion centered on the challenges posed by the European Cyber Resilience Act (CRA), particularly for industrial automation products with long lifecycles. Lutz Jänicke detailed the difficulties in meeting CRA requirements within tight timelines and the complexities of maintaining compliance over decades. Anton Arapov highlighted the distinction between open source stewardship and commercial vendor responsibilities under CRA.

The upcoming OpenSSL conference was reviewed, with confirmations of speaker notifications and attendee plans. Chris Ward confirmed his attendance and speaking role, while Kevin Micciche awaited budget approval. The conference is viewed as a vital event for community interaction.

Finally, the group discussed involvement in standards and regulatory committees related to CRA. Lutz Jänicke's leadership in German OT standardization and Anton Arapov's notes on advisory participation were highlighted, with plans for further collaboration to navigate regulatory challenges effectively.

The team discussed the introduction of a new lightweight form to streamline requests for guidance or feature requests related to OpenSSL. This form aims to facilitate open discussions and feedback within the community and corporate members, improving communication and tracking of issues. The form is inspired by a more extensive version used by CMUS and is intended to be made available as a template on the Lumino site for easy access.

• Jeff Johnson explains the creation of a lightweight request form to improve feedback and discussions around OpenSSL.

• Anton Arapov notes the need to discuss with Chris Ward how to integrate the form as a Lumino template.

• Kevin Micciche mentions plans to submit information using the new form after recent travel.

The group addressed the recent end of life (EOL) status of OpenSSL 3.0 as of September 7 and the implications for commercial support. Anton Arapov emphasized the importance of understanding client usage to determine ongoing support needs. Jeff Johnson and Barry Fussell noted that adoption of OpenSSL 3.0 was limited, with many moving to newer versions like 3.5. The team agreed to gather community feedback on continued use of 3.0 to inform support decisions.

• Anton Arapov confirms OpenSSL 3.0 reached EOL on September 7 and plans to survey clients about continued usage.

• Jeff Johnson and Barry Fussell observe that OpenSSL 3.0 adoption was not heavy, with preference for newer versions.

• The team commits to creating a community inquiry to assess ongoing use of OpenSSL 3.0.

Participants discussed the challenges posed by the European Cyber Resilience Act (CRA), especially for industrial automation products with long lifecycles. Lutz Jänicke highlighted the difficulty in meeting CRA requirements within tight timelines and the complexity of maintaining compliance for products expected to last 20-30 years. The conversation covered the need for risk-based approaches and the impact on both hardware and software vendors. Anton Arapov acknowledged the regulatory burden and the distinction between open source stewardship and commercial vendor responsibilities.

• Lutz Jänicke describes the CRA timeline challenges and the difficulty of compliance for long-lifecycle industrial products.

• Jeff Johnson notes the tough requirement of delivering software without CVEs amid third-party dependencies.

• Anton Arapov explains the foundation's lighter CRA impact due to its open source stewardship role versus commercial vendor obligations.

• Lutz Jänicke emphasizes existing product safety regulations and the additional CRA compliance layer for paid software support.

The upcoming OpenSSL conference scheduled for October 13-15 was reviewed, with confirmations of speaker notifications and attendee plans. Kevin Micciche is awaiting budget approval to attend, while others like Chris Ward confirmed participation and a speaking role. The conference is seen as an important opportunity for community engagement and knowledge sharing. Chris Ward offered support to help others attend if needed.

• Anton Arapov confirms all speakers have been informed and most have confirmed attendance.

• Kevin Micciche is pending finance approval for conference attendance but intends to push for participation.

• Chris Ward confirms he will attend and present on the community status alongside John Erikson.

• Jeff Johnson encourages attendees and notes the conference as a key event for the group.

The group touched on involvement in standards and regulatory committees related to CRA and cybersecurity. Lutz Jänicke chairs the German national committee for OT standardization and spends significant time on CRA-related work. Anton Arapov acknowledged limited direct involvement but noted some members, including representatives from Red Hat and the OpenSSL Corporation, participate in advisory roles. The need for better communication and collaboration on these topics was recognized.

• Lutz Jänicke chairs the German national committee for OT standardization and is deeply involved in CRA work.

• Anton Arapov notes some OpenSSL members participate in advisory roles for CRA and related standards.

• Jeff Johnson inquires about committee involvement to better understand regulatory impacts.

• Anton Arapov plans to consult Lutz Jänicke offline for guidance on CRA questions.

Action items AI-generated

• Chris Ward offered to assist anyone needing support to attend the OpenSSL conference and should be contacted by those requiring help.

• Anton Arapov will follow up offline with Lutz Jänicke to ask questions related to OT standardization and CRA compliance.

• Anton and Chris need to discuss how to implement the request for guidance form as a template on the Lumino site and decide on the next steps.

• Anton will reach out to all clients to understand who is still using OpenSSL 3.0 and for how long they plan to continue using it.

• Kevin Micciche needs to follow up with his finance team to confirm the budget and payment process for attending the upcoming OpenSSL conference and provide an update by the end of this or next week.

• Jeff Johnson will create a community question or communication to gather feedback on who is still running OpenSSL 3.0 and their plans regarding its usage.