Credential access
Can read private keys, certificates, encrypted files, and passphrases.
brew / approval gates
Install openssl@3 with Homebrew, apk, MacPorts, zypper, chocolatey, apt, dnf, Nix, pacman, scoop, winget
Cryptography and SSL/TLS Toolkit. Version 3.6.3 via Homebrew; verified 2026-07-06.
agent safety
Agent safety answer
openssl handles cryptographic keys, certificates, secrets, and encrypted payloads.
Remote mutation
Does not mutate remote systems directly but can prepare credentials used elsewhere.
Publish/artifact risk
Can produce keys, CSRs, signatures, and artifacts used in releases.
Recommended control
Gate private-key reads, key generation, signing, and decryption commands.
Agent-use guidance
Allow public certificate inspection; require approval before reading or producing secret key material.
install
Additional install commands
macOS
Homebrewverified · 100%
brew install openssl@3local Homebrew formula metadata
MacPortsverified · 94%
sudo port install openssl3MacPorts ports tree · devel/openssl3/Portfile · source: api.github.com
Linux
Alpine Linux apkverified · 92%
sudo apk add libssl3Alpine Linux edge package indexes · libssl3 · source: dl-cdn.alpinelinux.org
openSUSE zypperverified · 92%
sudo zypper install libopenssl-3-developenSUSE Tumbleweed package metadata · libopenssl-3-devel · source: download.opensuse.org
Debian aptverified · 92%
sudo apt install libssl-devDebian stable package indexes · libssl-dev · source: deb.debian.org
Fedora dnfverified · 92%
sudo dnf install opensslFedora Rawhide package metadata · openssl · source: dl.fedoraproject.org
Nixverified · 92%
nix profile install nixpkgs#opensslnixpkgs package indexes · openssl · source: raw.githubusercontent.com
Arch Linux pacmanverified · 92%
sudo pacman -S opensslArch Linux sync databases · openssl · source: geo.mirror.pkgbuild.com
Windows
Chocolateyverified · 92%
choco install opensslChocolatey community package catalog · openssl · source: community.chocolatey.org
Scoopverified · 92%
scoop install main/opensslScoop official bucket manifest trees · bucket/openssl.json · source: api.github.com
Windows Package Managerverified · 92%
winget install --id ShiningLight.OpenSSL.Dev -eWindows Package Manager source index · ShiningLight.OpenSSL.Dev · source: cdn.winget.microsoft.com
overview
Package summary
Cryptography and SSL/TLS Toolkit
Project links
Commands and aliases
No executable aliases were found in the local package database.
history
Project history and usage
Homebrew's `openssl@3` is the main OpenSSL 3 formula, providing the OpenSSL command-line tool plus libssl and libcrypto for TLS, SSL, certificate, and general cryptography workloads. The formula follows the default OpenSSL 3 branch while separate formulae such as `openssl@3.0` and `openssl@3.5` preserve branch-specific targets.
Project history
OpenSSL was founded in 1998 as an open-source successor to SSLeay, the SSL library by Eric A. Young and Tim J. Hudson. The first OpenSSL release, 0.9.1c, shipped on December 23, 1998 after the initial project team chose the OpenSSL name to signal continuity for users of SSL-era tooling.
The library became a default dependency for secure internet software, from Apache modules and mail servers to package managers, language runtimes, and appliance firmware. Heartbleed in 2014 revealed both the scale of OpenSSL deployment and the fragility of its funding and maintenance model, prompting foundation and governance changes.
The OpenSSL 3 generation began with 3.0.0 on September 7, 2021. Its provider architecture, Apache-2.0 licensing, FIPS provider support, and deprecation of low-level APIs reshaped how applications link, configure, and certify OpenSSL-based cryptography.
Adoption history
`openssl@3` is the broad Homebrew adoption path for OpenSSL 3. The cited formula page lists it as also known as `openssl` and `openssl@3.6`, bottled across macOS and Linux, with yearly installs in the millions.
Homebrew's page also shows the package-manager policy dimension: `openssl@3` can move between OpenSSL 3 minor branches, while `openssl@3.5` and `openssl@3.0` exist for consumers that need a pinned branch. That split lets Homebrew balance default freshness against downstream reproducibility.
How it is used
Users invoke the `openssl` CLI to inspect and generate certificates, create CSRs, test TLS endpoints, hash and sign data, convert PEM/DER/PKCS formats, and manage CA directories. Build systems link against libssl and libcrypto when compiling software that needs TLS, X.509, ASN.1, message digests, public-key cryptography, or provider-backed algorithms.
On Homebrew systems, dependent formulae use `openssl@3` as the normal OpenSSL 3 dependency, while users may need the formula's prefix, include path, library path, and certificate directory when compiling software outside Homebrew.
Why package nerds care
`openssl@3` is one of the packages that makes a package manager feel like infrastructure. A minor OpenSSL branch change can affect build flags, test suites, compliance assumptions, certificate lookup, and runtime behavior for a large dependency graph.
It is also a clean example of why versioned formula names matter. The package name encodes a compatibility promise at the major-version level, while sibling formulae encode stricter branch promises for software that cannot simply follow the default.
Timeline
- December 23, 1998: OpenSSL 0.9.1c is released.
- 2014: Heartbleed becomes a watershed event for OpenSSL maintenance and funding.
- September 7, 2021: OpenSSL 3.0.0 launches the OpenSSL 3 line.
- April 8, 2025: OpenSSL 3.5.0 is released in the OpenSSL 3 family.
- October 1, 2025: OpenSSL 3.6.0 appears in the OpenSSL release timeline.
- 2026: Homebrew lists `openssl@3` stable at 3.6.3 and notes a planned downgrade to 3.5 LTS before the 3.6 support window ends.
Related projects
- OpenSSL's ecosystem includes LibreSSL, BoringSSL, AWS-LC, GnuTLS, NSS, wolfSSL, and platform TLS stacks. Downstream packages such as OpenSSH, curl, web servers, database clients, and programming-language runtimes make OpenSSL branch choices visible far beyond cryptography specialists.
Sources
- https://docs.openssl.org/3.0/man7/migration_guide/
- https://formulae.brew.sh/formula/openssl@3
- https://github.com/openssl/openssl
- https://openssl-library.org/news/openssl-3.0-notes/
- https://openssl-library.org/news/openssl-3.5-notes/
- https://openssl-library.org/news/timeline/
- https://openssl-library.org/post/2018-12-20-20years/index.html
- https://openssl.foundation/about/history
approval gates
Human review metadata for risky commands
The local approval-gate seed includes 5 rules for openssl@3. Covered entrypoints: openssl. Severity labels: critical, high, medium. Coverage: partial, reviewed 2026-05-21.
Example gated actions
- Generate private keys or key pairs.
- Print private key details in text form.
- Export certificates and keys into PKCS#12 bundles.
- Connect to a remote TLS service and print handshake material.
- Encrypt or decrypt data to an output file.
local files
Configuration and credential file locations
These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.
Configuration files
Config paths the tool may read or write during local use.
- Unix
$OPENSSLDIR/openssl.cnf
Credential files
Credential-bearing paths to review before unattended agent runs.
- Unix
~/.ssl~/.certs~/certs~/.config/openssl
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
| No executable data was present. | |||
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-07-08
manager version3.6.3
manager updated2026-07-06
local dataok
upstreamnot checked
latest detectednot detected
https://github.com/openssl/openssl
- infoNo cached GitHub release or tag data was available.https://github.com/openssl/opensslnone confidence
install metadata
Package metadata
| Package key | brew:openssl@3 |
|---|---|
| Version | 3.6.3 |
| Package manager | Homebrew |
| Package manager page | https://formulae.brew.sh/formula/openssl@3 |
| Homepage | https://openssl-library.org |
| Repository | https://github.com/openssl/openssl |
| Upstream docs | https://docs.openssl.org/3.6/man1/openssl |
| License | Apache-2.0 |
| Source archive | https://github.com/openssl/openssl/releases/download/openssl-3.6.3/openssl-3.6.3.tar.gz |
| Last updated | 2026-07-06T17:12:11Z |
| Pulse | updated |
| Dependencies | ca-certificates |
| Bottle | available (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sequoia, sonoma, tahoe, x86_64_linux) |
| Homebrew post-install | not defined |
| Service | none declared |
| Caveats | To add additional certificates, place .pem files in $HOMEBREW_PREFIX/etc/openssl@3/certs and run $HOMEBREW_PREFIX/opt/openssl@3/bin/c_rehash OpenSSL 3.6 is only supported until 2026-11-01 so the `openssl@3` formula will be downgraded to OpenSSL 3.5 (LTS) in a future update. |
registry facts
Source database details
| Source Database | Homebrew formula API |
|---|---|
| Tap | homebrew/core |
| Full Name | openssl@3 |
| Aliases |
|
| Version Scheme | 0 |
| Revision | 0 |
| Bottle Stable Root URL | https://ghcr.io/v2/homebrew/core |
| Deprecated | no |
| Disabled | no |
| Keg Only | no |
| URL Keys |
|
source database matches
Other package-manager records
Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.
apk95%
libssl3 3.5.7-r0
SSL shared libraries
sudo apk add libssl3- License: Apache-2.0
- Architecture: x86_64
- Source Package: openssl
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Openssl 3
zypper95%
libopenssl-3-devel 3.5.3-5.1
Development files for OpenSSL
sudo zypper install libopenssl-3-devel- License: Apache-2.0
- Category: Unspecified
- Architecture: x86_64
- Source Package: openssl-3
- 4 dependencies
- 3 provides
- normalized package name match
- Matched by: Openssl 3
zypper95%
libopenssl-3-devel-32bit 3.5.3-5.1
Development files for OpenSSL
sudo zypper install libopenssl-3-devel-32bit- License: Apache-2.0
- Category: Unspecified
- Architecture: x86_64
- Source Package: openssl-3
- 2 dependencies
- 2 provides
- normalized package name match
- Matched by: Openssl 3
zypper95%
libopenssl-3-fips-provider 3.5.3-5.1
OpenSSL FIPS provider
sudo zypper install libopenssl-3-fips-provider- License: Apache-2.0
- Category: Unspecified
- Architecture: x86_64
- Source Package: openssl-3
- 4 dependencies
- 2 provides
- normalized package name match
- Matched by: Openssl 3
zypper95%
libopenssl-3-fips-provider-32bit 3.5.3-5.1
OpenSSL FIPS provider
sudo zypper install libopenssl-3-fips-provider-32bit- License: Apache-2.0
- Category: Unspecified
- Architecture: x86_64
- Source Package: openssl-3
- 4 dependencies
- 1 provides
- normalized package name match
- Matched by: Openssl 3
zypper95%
libopenssl-3-fips-provider-x86-64-v3 3.5.3-5.1
OpenSSL FIPS provider
sudo zypper install libopenssl-3-fips-provider-x86-64-v3- License: Apache-2.0
- Category: Unspecified
- Architecture: x86_64
- Source Package: openssl-3
- 3 dependencies
- 1 provides
- normalized package name match
- Matched by: Openssl 3
zypper95%
libopenssl3 3.5.3-5.1
Secure Sockets and Transport Layer Security
sudo zypper install libopenssl3- License: Apache-2.0
- Category: Unspecified
- Architecture: x86_64
- Source Package: openssl-3
- 7 dependencies
- 5 provides
- normalized package name match
- Matched by: Openssl 3
zypper95%
libopenssl3-32bit 3.5.3-5.1
Secure Sockets and Transport Layer Security
sudo zypper install libopenssl3-32bit- License: Apache-2.0
- Category: Unspecified
- Architecture: x86_64
- Source Package: openssl-3
- 4 dependencies
- 4 provides
- normalized package name match
- Matched by: Openssl 3
zypper95%
libopenssl3-x86-64-v3 3.5.3-5.1
Secure Sockets and Transport Layer Security
sudo zypper install libopenssl3-x86-64-v3- License: Apache-2.0
- Category: Unspecified
- Architecture: x86_64
- Source Package: openssl-3
- 2 dependencies
- 2 provides
- normalized package name match
- Matched by: Openssl 3
zypper95%
openssl-3 3.5.3-5.1
Secure Sockets and Transport Layer Security
sudo zypper install openssl-3- License: Apache-2.0
- Category: Unspecified
- Architecture: x86_64
- Source Package: openssl-3
- 8 dependencies
- 2 provides
- normalized package name match
- Matched by: Openssl 3
zypper95%
openssl-3-doc 3.5.3-5.1
Manpages and additional documentation for openssl
sudo zypper install openssl-3-doc- License: Apache-2.0
- Category: Unspecified
- Architecture: noarch
- Source Package: openssl-3
- 2 provides
- normalized package name match
- Matched by: Openssl 3
MacPorts95%
openssl3
sudo port install openssl3- normalized package name match
- Matched by: Openssl 3
Debian apt88%
libssl-dev 3.5.6-1~deb13u1
Secure Sockets Layer toolkit - development files
sudo apt install libssl-dev- Section: libdevel
- Architecture: amd64
- Source Package: openssl
- 1 dependencies
- 1 optional deps
- versioned package alias match
- Matched by: Openssl
Debian apt88%
libssl-doc 3.5.6-1~deb13u1
Secure Sockets Layer toolkit - development documentation
sudo apt install libssl-doc- Section: doc
- Architecture: all
- Source Package: openssl
- versioned package alias match
- Matched by: Openssl
Debian apt88%
libssl3t64 3.5.6-1~deb13u1
Secure Sockets Layer toolkit - shared libraries
sudo apt install libssl3t64- Section: libs
- Architecture: amd64
- Source Package: openssl
- 4 dependencies
- 1 provides
- versioned package alias match
- Matched by: Openssl
Debian apt88%
openssl 3.5.6-1~deb13u1
Secure Sockets Layer toolkit - cryptographic utility
sudo apt install openssl- Section: utils
- Architecture: amd64
- 2 dependencies
- 1 optional deps
- versioned package alias match
- Matched by: Openssl
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Nucleus package database
- approval-gate seed metadata
- cross-ecosystem install command graph
- curated agent safety answer
- curated configuration and credential file locations
- curated package history
- external package-manager database matches
- package relationship graph
- package version freshness
- package-page enrichment