Meeting Minutes: Board and TAC Monthly (2026-09-14)

Below are the minutes from the recent TAC and Board of Directors meeting. All members receiving this notification are encouraged to review the minutes and actively participate in the discussion. That's one of the opportunities to engage directly with TAC members by replying in the thread below. Your input helps us ensure the OpenSSL community remains transparent, collaborative, and responsive to your needs.

Attendees

Anton Arapov, Chris Ward, Simo Sorce, Aditya Koranga, Nikolas Gauder

High-level topics covered

• Joint BAC/TAC panel planning

• API/ABI stability (OpenSSL 4.0 ASN1 behavior change)

• Rust ecosystem crate ownership

• FIPS mode macro vote and entropy/PQC certification strategy

• Committee seat vacancy

• Conference logistics

Detailed points and discussion

1) Conference and joint panel planning

Attendance was confirmed for several TAC members. The joint BAC/TAC panel, moderated by Chris Ward, will focus on topics where committee opinions differ. The regular TAC call during conference week is cancelled; a joint preparation call will be scheduled for Monday September 28.

2) API/ABI stability

A semantic change to ASN1 string behavior in OpenSSL 4.0, introduced without an API name change or changelog update, broke downstream consumers. The change is being reviewed for reversion. The committee also discussed the sustainability of ABI-breaking changes with each major version release and agreed the topic warrants further discussion on release cadence and backward compatibility. Discussion only.

3) Rust ecosystem

Discussion: The 'openssl' crate on crates.io is not owned by the project, promotes deprecated APIs, and creates naming and dependency conflicts. An ecosystem review and outreach to the crate's current maintainers was discussed.

4) FIPS certification and entropy

The FIPS mode macro reinstatement passed as formal TAC advice (7-1). OpenSSL 3.5.8 is in CMVP validation; the certification approach for 4.0 remains undecided. New NIST entropy-source validation rules add requirements for kernels and OpenSSL; use of CPU-native entropy certificates (Intel/AMD RDRAND/RDSEED) is being explored as a mitigation.

5) Committee operations

The Small Business committee seat remains vacant. Logistics support (huddle spaces, conference-related coordination) will continue to be handled by Chris Ward.

Action items