Deployment of OpenSSL3.0 (now EOL)
poll by Jeff Johnson Closed Sun 20 Sep 2026 1:00PM
Results of the OpenSSL3.0 deployment poll:
70% deployed but not critical (most are migrating to later releases)
15% deployed and critical. (will need extended support)
15% doesn't use or didn't deploy.
Thanks for all who participated!
-jj (on behalf of the LBC Business Advisory Committee)
What is this poll about?
OpenSSL3.0 went EOL on 9/7/2026. Given that version was the first LTS with the new architecture, OpenSSL would like to know how widely deployed (or used) OpenSSL3.0 is.
Why is this important?
OpenSSL would like this data to make better decisions on LTS and version lifecycle.
What are you asking people to do?
Please choose the option below that best describes your usage of OpenSSL3.0.
Choose the option(s) you favor.
Results
| Results | Option | % of points | Voters | |||
|---|---|---|---|---|---|---|
| My business did deploy OpenSSL3.0 but it isn't critical. | 70 | 14 |        | |||
| My business doesn't use or didn't deploy OpenSSL3.0. | 15 | 3 |   | |||
| My business did deploy OpenSSL3.0 and it is CRITICAL for us. | 15 | 3 |  | |||
| Not voted | 123 |             |
We have transitioned to OpenSSL 3.5.
Updating from v1.1.1 to v3.0 took us many months and many fixes for third-party dependencies, but minor version updates were smooth and usually done within a few days.
We deployed the first release, but have been updating to newer releases based on End of Life dates and the desire to deploy PQC (3.5), so our products in the field with 3.0 are either already out of support or have an update available.
We are migrating to OpenSSL 3.5.4+
We skipped 3.0 and went straight from 1.1 to 3.5
We will still, however, have a need to support 3.0 for some existing releases in the field
We did deploy OpenSSL3.0 but little adoption since there is a push to PQ and FP3.5.
We (RHEL) ship OpenSSL 3.0.7 in older, but still supported versions — whether our customers actually use that or not, and for what purposes we don't know, though. So I can't really answer this poll.
However, we do our own support of this release anyway and do not depend on upstream's maintenance of the 3.0 release.
Continue using it for FIPS 140-2.
I have been out of office, but I'd like to mention, that we did deploy OpenSSL 3.0 and it is critical.
@Yi Ouyang 140-2 certificates have all expired and moved to the Historical list today.