November 2026 LBC Meeting Minutes

Your Webex meeting content is available.

OpenSSL LBC Monthly Meeting

Host: Jeff Johnson

Tuesday, November 10, 2026

10:29 AM  |  (UTC-05:00) Eastern Time (US & Canada)  |  55 mins

Recording

Topic

Password

OpenSSL LBC Monthly Meeting-20261110 1627-1

Jq36pW8V

Meeting summary AI-generated

Key participants: Jeff Johnson (Cisco, large business community representative) chairs the meeting; Chris Ward (OpenSSL community manager) provides foundation and process context; additional active contributors include Kevin Micciche (HPE), Tim Chevalier (NetApp), Christian Vögl (NCP), Watson Ladd (Akamai), Igor Ageyev (Wind River), Norman Ashley, Helen Zhang, and others.

Main topics and outcomes: The group reviews OpenSSL leadership changes (Anton becomes president; Tim retains CEO/board roles), and discusses improving the board-community feedback loop—Chris is leading efforts to gather prioritized feature and policy lists from communities for upcoming releases (targeting OpenSSL 4.2 LTS and 5.0). The team debates how to structure community discussion channels to keep substantive technical and policy threads inside relevant community forums.

Security and standards work: The meeting covers status on FIPS 140-3 and CMVP interactions (OpenSSL has responded to comments and seeks any NIST/CMVP contacts to help unblock review). Common Criteria engagement is advancing; Jeff will convene a smaller working group (Tim and Kevin volunteered interest) to specify business needs (entropy, DRBGs, etc.) to guide technical work. Attendees also flag PQC and TLS roadmap concerns: draft RFCs for pure post-quantum TLS are progressing, and US certification stances complicate hybrid approaches. Kevin warns that absent timely community implementation, forks or ad hoc solutions may proliferate; the group agrees to fold PQC release timing and algorithm support into the Common Criteria/roadmap discussions, with 4.x considered for nearer-term support.

Operational features: A poll on prioritization for OpenSSL features shows a majority favoring upstream UPKI integration over enabling Certificate Transparency by default, but participants view the two as complementary. Key concerns include platform-specific behavior (notably Windows—if Microsoft does not ship UPKI support, OpenSSL may need to implement components or provide interfaces) and the desire for a single OS-level UPKI daemon with library interfaces so multiple crypto libraries can interoperate.

Events and coordination: The group plans face-to-face meetups around FOSDEM, ICMC, RSA, and possible events in Toronto or Bern; Jeff and Chris ask members to respond to polls for attendance. Conference feedback emphasizes strong technical and legal/compliance tracks, but logistics (networking noise, room scheduling) need improvement; Jeff commits to better coordination.

Commitments and next steps: Jeff will schedule follow-up meetings: (1) a Common Criteria focused session to gather business requirements and roadmap input (Kevin, Tim, and others offered to participate); (2) a PQC/algorithm implementation discussion included in that roadmap work; (3) share the crypto-agility working group invitation and details with the community. Chris will continue to collect prioritized lists from communities and manage discussion-channel changes. Jeff will post meeting notes publicly and circulate links and action items.

Concerns: Timely implementation for PQC and certification alignment is urgent to avoid fragmentation; UPKI on Windows raises deployment questions; progress with NIST/CMVP for FIPS certification may require external contacts to unblock reviews. Overall, the meeting identifies clear topics for targeted follow-ups and volunteer support to move standards, certification, and feature prioritization forward.

The group reviews recent leadership changes at the OpenSSL Foundation: Tim steps down as president while retaining other roles and Anton assumes the president role. This matters because it affects decision-making and the board-community feedback loop; attendees are monitoring how Anton's new responsibilities will influence project priorities. Chris confirms the personnel changes and signals intent to observe impacts moving forward.

• Jeff Johnson reports that Anton is now president of OpenSSL and that Tim stepped down from the president role while retaining CEO and board positions.

• Chris Ward confirms Tim remains active in other roles and says the community will watch how Anton's presidency affects project direction.

Attendees discuss improving how community input reaches the board and how the board closes feedback loops back to communities. The conversation highlights past examples where community feedback influenced technical decisions (e.g., FIPS mode) and identifies the need for clearer, prioritized input channels. Chris is leading efforts to gather prioritized lists from communities for OpenSSL releases (4.x and 5.0) and to refine communication channels such as community-specific discussion areas.

• Jeff Johnson outlines an action item to close the loop between the board and communities so community input receives timely responses.

• Chris Ward requests prioritized feature and policy lists from communities for consideration in OpenSSL 4.2 LTS and 5.0 roadmaps.

• Jeff cites the FIPS mode example as a case where community-driven feedback successfully influenced a decision.

The group reviews possible changes to the general discussions area to keep conversations focused within discrete communities. The intent is to avoid diffuse, generic threads and instead surface substantive discussions inside community forums before promoting them through the TAC and board. Chris has opened a thread soliciting feedback on redesigning discussion channels.

• Chris Ward explains the intention to keep substantive discussion within community-specific forums rather than a single general discussions area.

• Chris invites attendees to contribute to the thread he created to shape how discussion channels are structured.

Billy Broadland (academic board representative) updates on student involvement; faculty and students are contributing to OpenSSL as a learning pathway. The group emphasizes the value of academic contributors for community growth and code contributions. Jeff notes Billy is approachable and encourages connecting with him for academic involvement.

• Jeff Johnson reports that Billy Broadland is engaging students to learn OpenSSL by contributing to the project.

• Jeff suggests members reach out to Billy for questions or to explore academic contribution opportunities.

Attendees discuss progress on FIPS 140-3 and CMVP interactions; OpenSSL has responded to comments and the work is cycling back to CMVP. Anton expresses confidence that steward/foundation arrangements and vendor responsibilities are in order. The group asks for assistance or contacts at NIST/CMVP to help unblock review if available.

• Jeff Johnson reports OpenSSL responded to CMVP comments and the submission is back with CMVP for review.

• Chris Ward and Jeff ask the group to share any NIST/CMVP contacts that could help accelerate review and resolution.

The team discusses engagement with Common Criteria (CC) and BSI; OpenSSL board members and distributions are exploring CC work and possible vendor contributions. Jeff proposes compiling business needs for CC to guide technical efforts, and volunteers (Tim, Kevin, others) offer to form a smaller working group to define requirements and inputs. A follow-up meeting will be scheduled to consolidate community input.

• Jeff Johnson notes discussions with BSI and that distributions (via board delegate Yasalv) have CC expertise to contribute.

• Tim Chevalier volunteers to help, citing interest in entropy sources and DRBGs relevant to CC evaluations.

• Kevin Micciche offers to be looped into the CC conversation and says he has domain knowledge to contribute.

Attendees plan face-to-face meetups tied to conferences (FOSDEM, ICMC, RSA, Mobile World Congress) to gather prioritized lists and foster community coordination. Jeff proposes a large business meetup the day before FOSDEM and mentions exploring additional events (Toronto pre-ICMC, Bern in May). Chris asks interested members to respond to community polls to confirm attendance and preferences.

• Jeff Johnson proposes a large business community meetup the day before FOSDEM to gather priorities for OpenSSL.

• Chris Ward says OpenSSL is exploring face-to-face events in Toronto (around ICMC) and Bern in May and asks attendees to reply to polls about attendance.

Members share feedback from the recent OpenSSL conference: overall strong technical content, valuable legal/compliance track, but networking logistics (loud music, difficulty booking meeting rooms) need improvement. Jeff accepts responsibility for coordination lapses on the community meetup and commits to better planning next time. Norman suggests clearer room scheduling and registration options for ad hoc meetups.

• Christian Vögl praises the conference content but notes the networking evening music was too loud for conversations.

• Norman Ashley recommends improving registration or an option to indicate demand for meet-up rooms to simplify scheduling.

• Jeff Johnson acknowledges dropped coordination on the face-to-face large business meetup and commits to better organization next time.

The group analyzes a poll asking which feature OpenSSL should prioritize if it could only pick one: UPKI integration or enabling Certificate Transparency (CT). Poll results show ~61% favoring UPKI, ~39% favoring CT. Attendees generally view UPKI and CT as complementary and emphasize UPKI's operational necessity (e.g., OS-level trust and revocation decisions) while noting platform-specific constraints (Windows availability) and desire for a single OS-level daemon/interface.

• Jeff Johnson summarizes poll results showing 61% support for UPKI support first and 39% for enabling CT by default.

• Watson Ladd argues UPKI integration is important because system software needs the ability to enforce trust decisions (e.g., block intermediates or not trust after a date).

• Igor Ageyev recommends a single OS-level UPKI daemon with a library interface so multiple crypto libraries can interoperate, and notes UPKI and CT are complementary.

• Christian Vögl raises concern that if Microsoft doesn't ship UPKI support on Windows, OpenSSL may need to provide it, which raises questions about whether the library should include a daemon.

Attendees list upcoming events relevant to the community (IETF 127, PKI Consortium PQC event, FOSDEM, RSA, ICMC, Mobile World Congress) and encourage coordination for attendance and pre-conference meetups. Chris confirms OpenSSL plans to attend Mobile World Congress and is focused on the forthcoming OpenSSL conference schedule and CFP. Members share limited travel budgets and prioritize events based on roles.

• Chris Ward notes IETF 127 (Nov 14-20) and says OpenSSL plans to attend.

• Kevin Micciche mentions the PKI Consortium PQC conference in early December and suggests attendees check its online program.

• Chris Ward indicates OpenSSL likely will attend Mobile World Congress Barcelona (March 1-4) and asks members to watch for upcoming CFPs.

Kevin raises concerns about draft RFCs for pure post-quantum TLS (non-hybrid) progressing toward publication and the US government's stance favoring non-hybrid approaches for certification. Members note this could force forks or custom implementations if OpenSSL doesn't provide timely support. The group recommends tying this topic into the Common Criteria discussion and scheduling a focused meeting to discuss algorithm support and release timing (likely 4.x rather than 5.0 for near-term needs).

• Kevin Micciche reports draft RFCs for pure post-quantum TLS progressed through appeals and are nearing publication, and that US certification paths are not favoring hybrid solutions.

• Kevin warns that lack of timely community implementation may lead to forks or in-house implementations and urges OpenSSL to consider roadmap timing for PQC (targeting a 4.x release rather than 5.0).

• Jeff Johnson and attendees agree to include PQC algorithm implementation and certification implications in the planned Common Criteria/roadmap discussions.

Participants discuss the impact of post-quantum key sizes on protocols like IPSec. Kevin explains RFC approaches (e.g., separate classical and PQ key exchanges or pre-shared-key methods) that avoid pure hybrid concatenation issues and references existing implementations (strongSwan, Cloudflare assessments). Christian remains concerned about message size, but Kevin shares mitigations and RFC guidance addressing negotiation and fragmentation.

• Christian Vögl expresses concern that PQC key sizes could exceed IPSec message limits.

• Kevin Micciche explains RFC 9370-style approaches and strongSwan support that negotiate separate classical and PQ exchanges to mitigate size issues and references Cloudflare's testing.

Jeff shares notice about a new crypto agility working group initiated by Marisa (and related contacts), intended to coordinate work around crypto agility and standards. Members express interest in joining; Jeff will share meeting links and invite details with the group notes. The working group may help align standards, implementations, and community expectations.

• Jeff Johnson notifies attendees about a new crypto-agility working group and says he will circulate the invitation and questionnaire link.

• Kevin Micciche and others express interest in following or joining the working group to stay aligned on agility efforts.

Action items AI-generated

• Jeff Johnson to set up a follow-up meeting/workshop focused on post-quantum algorithm implementation, roadmap milestones, and how OpenSSL should support hybrid vs pure approaches; invite broader company participation as suggested by Kevin.

• Jeff Johnson to set up a meeting for interested members to discuss Common Criteria requirements and what OpenSSL could provide; include Tim Chevalier and Kevin Micciche among invitees.

• Chris Ward to continue leading the effort to close the feedback loop between communities and the OpenSSL board and follow up on next steps.

• Kevin Micciche to look for the meeting invite about PQC/standards and remind Jeff to join, and to identify colleagues who could join the roadmap conversation.

• Kevin Micciche to share the referenced policy 33 and RFC drafts / references about PQC and CNSA 2.0 with Jeff and the group for tracking and to help inform roadmap discussions.

• Chris Ward to follow up with Jeff about potential collaboration on Common Criteria work and BSI interactions.

• Jeff Johnson to coordinate and improve scheduling/coordination for large business community face-to-face meetings at upcoming conferences and share meeting details.

• Jeff Johnson to include and post the invitation/link to the new crypto agility working group (invitation from Marisa/Maerojo/Bill Newhouse) along with meeting notes.

• Attendees to respond to the face-to-face meetup polls (Faustin/ICMC/RSA/Toronto/Berno) indicating availability and interest so organizers can plan large business meetups around conferences.

• Any attendee with contacts at NIST or CMVP to share those contacts with the OpenSSL team to help with the FIPS/CMVP review process.

• Jeff Johnson to send a general invitation for a Common Criteria discussion (open to anyone) and plan to include it as a potential face-to-face agenda item.

• Community members to gather and submit prioritized feature/issue lists for OpenSSL (especially for 5.0 and 1.2 LTS) and share them with the delegates.

• Chris Ward to summarize the 'general discussions' thread and invite community feedback on keeping conversations focused inside communities.