OpenSSL
OpenSSL 1.1.1 (LTS)
OpenSSL 1.1.1 (LTS)
The OpenSSL 1.1.1 (LTS) reached end of service life on Sep 11, 2023. Third-party maintenance keeps it supported — 24/7 engineering support and same-day replacement parts — at 40-70% below OEM renewal pricing.
End of Service LifeEOSL Date: Sep 11, 2023
Specifications
- product
- openssl
- release
- 1.1.1
- product Label
- OpenSSL
- release Label
- 1.1.1 (LTS)
- codename
- lts
- true
- latest Version
- 1.1.1w
- release Date
- 2018-09-11
- maintained
- true
- source Url
- https://endoflife.date/openssl
Lifecycle Dates
- End of Service Life
- Sep 11, 2023
- Last OEM Support
- Sep 11, 2023
OEM vs. 3rd Party Support
See how 3rd party maintenance compares to traditional OEM support for your OpenSSL 1.1.1 (LTS). Get the same level of service at a fraction of the cost.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| 24/7/365 Support | ||
| Same-Day Parts Replacement | Limited | |
| Mixed-Vendor Support | ||
| Flexible Contract Terms | Annual Only | Month-to-Month Available |
| Asset Lifecycle Extension | ||
| OEM-Trained Engineers |
Why Choose 3rd Party Support for OpenSSL 1.1.1 (LTS)?
Save 40-70%
Dramatically reduce your maintenance costs while maintaining the same level of support coverage.
Extend Asset Life
Continue using your OpenSSL 1.1.1 (LTS) well beyond the OEM end-of-life date.
24/7 Expert Support
OEM-trained engineers available around the clock with same-day parts replacement.
OpenSSL 1.1.1 (LTS) Support: Frequently Asked Questions
Is the OpenSSL 1.1.1 (LTS) still supported?
OpenSSL ended support for the OpenSSL 1.1.1 (LTS) on Sep 11, 2023. Third-party maintenance remains available and keeps the OpenSSL 1.1.1 (LTS) supported with 24/7 engineering support and same-day replacement parts.
When is the OpenSSL 1.1.1 (LTS) end of service life (EOSL) date?
OpenSSL lists the end of service life for the OpenSSL 1.1.1 (LTS) as Sep 11, 2023.
Can I keep using the OpenSSL 1.1.1 (LTS) after its EOSL date?
Yes. EOSL means OpenSSL stops selling support contracts and issuing updates — the equipment itself keeps working. Third-party maintenance provides engineering support and replacement parts for as long as you choose to run it.
How much does third-party support for the OpenSSL 1.1.1 (LTS) cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location — request a quote and we respond within 24 hours.
Known Vulnerabilities Affecting OpenSSL 1.1.1 (LTS)
12 published CVEs affect the OpenSSL 1.1.1 (LTS), including 3 rated critical or high severity. OpenSSL no longer ships security patches for this release — our engineers provide mitigation guidance, workarounds and hardening support.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-69421 | HIGH | 7.5 | Jan 27, 2026 | Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function. Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processing PKCS#12 files. The PKCS12_item_decrypt_d2i_ex() function does not check whether the oct parameter is NULL before dereferencing it. When called from PKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can be NULL, cau |
| CVE-2020-1967 | HIGH | 7.5 | Apr 21, 2020 | Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect |
| CVE-2019-1543 | HIGH | 7.4 | Mar 6, 2019 | ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. It is a requirement of using this cipher that |
| CVE-2018-0734 | MEDIUM | 5.9 | Oct 30, 2018 | The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p). |
| CVE-2018-0735 | MEDIUM | 5.9 | Oct 29, 2018 | The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1). |
| CVE-2023-3817 | MEDIUM | 5.3 | Jul 31, 2023 | Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a |
| CVE-2023-3446 | MEDIUM | 5.3 | Jul 19, 2023 | Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ('p' |
| CVE-2019-1551 | MEDIUM | 5.3 | Dec 6, 2019 | There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications |
| CVE-2019-1549 | MEDIUM | 5.3 | Sep 10, 2019 | OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If |
| CVE-2019-1547 | MEDIUM | 4.7 | Sep 10, 2019 | Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result i |
| CVE-2019-1563 | LOW | 3.7 | Sep 10, 2019 | In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functi |
| CVE-2019-1552 | LOW | 3.3 | Jul 30, 2019 | OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory is most commonly referred to as OPENSSLDIR, and is configurable with the --prefix / --openssldir configuration options. For OpenSSL versions 1.1.0 and 1.1.1, the mingw configuration targets assume that resulting programs and libraries are installed in a Unix-like environment and the default prefix for program installation as well as for OP |
Related OpenSSL Products
All OpenSSL products →OpenSSL 1.1.1 (LTS)
Save 40-70% vs OEM