OpenSSL is covered by one of two licenses, depending on which release is involved. In all cases, there is a file named LICENSE in the top-level of the release. Copies can also be found here.

For the 3.0 release, and later releases derived from that, the Apache License v2 applies. This also applies to the git “master” branch.

For any release made before OpenSSL 3.0 (namely the 1.1.1, 1.1.0, 1.0.2, and all prior releases including those not currently supported), the dual OpenSSL and SSLeay license applies. Note that this is also true for any updates to those releases – the “letter suffix” – no matter when they are made. It also applies to the git branches for all those releases, and to any public forks that have not rebased to master (or 3.0).