Library · archived
OpenSSL
OpenSSL 3.0, the current long-term-support branch, stops receiving fixes
left 7 Sept 2026
Quick answers
- Is it true that OpenSSL 3.0 end-of-life?
- Yes — and the date has already passed (7 Sept 2026). OpenSSL 3.0 is the LTS branch that shipped with a large share of long-lived Linux distributions and vendor appliances, so this is one of the widest-reaching dates on the calendar.
- When did it take effect?
- 7 Sept 2026 (already passed). Verified against the vendor's own announcement.
- What should I use instead?
- Move to a supported branch — 3.5 is the current LTS.
What this means for you
OpenSSL 3.0 is the LTS branch that shipped with a large share of long-lived Linux distributions and vendor appliances, so this is one of the widest-reaching dates on the calendar. After it passes, no further fixes are published for 3.0 — including security fixes. Anything still linked against it keeps working, and that is the danger: nothing breaks visibly, the patches simply stop arriving.
Where to go
Move to a supported branch — 3.5 is the current LTS. If you consume OpenSSL through your distribution rather than directly, the relevant date is usually your distro's, not this one: distributions with their own long support windows (RHEL, Ubuntu LTS) backport fixes into their 3.0 packages beyond upstream EOL. Check whether your vendor does before assuming you are exposed, and check whether it does not before assuming you are safe.
- OpenSSL 3.5 (LTS)
- Distribution-backported OpenSSL 3.0, where your vendor offers it
OpenSSL publishes support windows on a single release-strategy page, and 3.0 has carried an explicit LTS marker there since it shipped: “supported until 2026-09-07 (LTS)”.
The reason this one deserves attention out of proportion to its size is the indirection. Very few teams install OpenSSL deliberately; they inherit it, through a base image, a package manager, a language runtime, or a piece of hardware. The upstream date is therefore not automatically your date — but it is the date after which no one upstream is looking at 3.0 anymore, and every backport downstream of it becomes someone else’s discretionary effort.
Worth checking now rather than in September: what your container base images actually link against, and whether your appliance vendors have said anything at all.
Entry changelog
- — last reviewed.
- — End-of-life date reached. OpenSSL 3.0's LTS support window (supported until 2026-09-07) came due; status moved to passed. Re-confirmed against the official release-strategy page that the "supported until 2026-09-07 (LTS)" marker for 3.0 is unchanged before marking it. After this date 3.0 receives no further upstream fixes, security included; distribution-backported 3.0 (RHEL, Ubuntu LTS) may still be maintained separately.
- — Entry created from the official release-strategy page.
Put this countdown in your README
Building on OpenSSL? Drop this badge into a project’s README or docs — it shows the days left and
refreshes on its own every night from this page. 
[](https://lastcall.dev/entries/openssl-3-0-eol)Spot an error or a changed date? Tell us and it’s corrected the same night.