OpenSSL 3.6 Series Release Notes

The major changes and known issues for the 3.6 branch of the OpenSSL toolkit are summarised below. The contents reflect the current state of the NEWS file inside the git repository.

More details can be found in the ChangeLog.

Major changes between OpenSSL 3.5 and OpenSSL 3.6.0 [1 Oct 2025]

This release incorporates the following potentially significant or incompatible changes:

• Added NIST security categories for PKEY objects.

• Added support for EVP_SKEY opaque symmetric key objects to the key derivation and key exchange provider methods. Added EVP_KDF_CTX_set_SKEY(), EVP_KDF_derive_SKEY(), and EVP_PKEY_derive_SKEY() functions.

• Added LMS signature verification support as per SP 800-208. This support is present in both the FIPS and default providers.

• An ANSI-C toolchain is no longer sufficient for building OpenSSL. The code should be built using compilers supporting C-99 features.

• Support for the VxWorks platforms has been removed.

• Added an openssl configutl utility for processing the OpenSSL configuration file and dumping the equal configuration file.

• Added support for FIPS 186-5 deterministic ECDSA signature generation to the FIPS provider.

• Deprecated EVP_PKEY_ASN1_METHOD-related functions.