Repository navigation
Add OpenSSL 3.5 support to CPython infrastructure #132339
Description
Activity
For what it's worth, I was able to use the build installer script to build
_hashlib.cpython-314-darwin.soand_ssl.cpython-314-darwin.so, but didn't engage in any comprehensive testing of their correctness.Another motivation to upgrade - openSSL fixed performance issues in windows in 3.4.1, which according to my tests, have high impact
Do we know if CPython is compatible with OpenSSL 3.5 and just doesn't have the build magic, or if work is required to make it compatible? Or is this an unknown? I know that previous updates took some work (see #83001).
I'm interested in getting this added to astral-sh/python-build-standalone, but wanted to check what the state of play is upstream.
@tiran, could you please provide some insight if possible 😇
Step 1 is to get 3.5 added to the existing multi-ssl CI testing, which should be straightforward to do and should give an indication of whether further work is required.
Reacted by Edward KnightThanks to @zware et al., we have full OpenSSL 3.5 support in CPython 3.14+ 🥳
Regarding the rest of this issue:
OpenSSL 3.5 is the only version with free public support beyond 2026, and lining up this with the Python release schedules, it looks like ideally 3.11—3.14 would all support OpenSSL 3.5 to overlap the OpenSSL window.
I agree, and would love to see full OpenSSL 3.5 support in versions earlier than 3.14, but it looks like the changes won't be backported: #127331 (comment)
However, it sounds like versions prior to 3.14 (3.13 in particular) will work (are compatible) if compiled with OpenSSL 3.5, but will be missing messages for the new error codes. Since this won't impact any major functionality I'm going to look at getting OpenSSL 3.5 into astral-sh/python-build-standalone for Python 3.11—3.14
Assuming nothing more is going to change in CPython, should we consider this issue closed?
Indeed, let's close this issue due to: #127331 (comment)
- added a commit that references this issue
on Oct 27, 2025
On April 8th, 2025 OpenSSL 3.5 was released, the latest OpenSSL LTS: https://openssl-library.org/post/2025-04-08-openssl-35-final-release/
Here is a table of the OpenSSL release roadmap and deprecation schedule from1:
OpenSSL 3.5 is the only version with free public support beyond 2026, and lining up this with the Python release schedules, it looks like ideally 3.11—3.14 would all support OpenSSL 3.5 to overlap the OpenSSL window. I haven't assessed how complicated the internal changes, but wanted to start the process based on the discussion in #131423.
Linked PRs
Footnotes
https://openssl-library.org/roadmap/ ↩