OpenSSL Windows libraries

[upsidasi]

Hi,

While updating my Lazarus to 2.2.4 (FPC 3.2.2) on Windows, I've noticed that it is not distibuted with the SSL libraries ssleay32.dll / libeay32.dll (as it was with version 2.0.10) but with libssl-1_1-x64.dll / libcrypto-1_1-x64.dll.

Is there a thread or a page explaining why?

Anyway, I checked the openssl.pas file:

Code: Pascal  [Select][+][-]

1.   {$IFDEF WINDOWS}
2.   DLLSSLName: string = 'ssleay32.dll';
3.   DLLSSLName2: string = 'libssl32.dll';
4.   DLLSSLName3: string = {$IFDEF WIN64}'libssl-1_1-x64.dll'{$ELSE}'libssl-1_1.dll'{$ENDIF};
5.   DLLUtilName: string = 'libeay32.dll';
6.   DLLUtilName2: string = {$IFDEF WIN64}'libcrypto-1_1-x64.dll'{$ELSE}'libcrypto-1_1.dll'{$ENDIF};
7.   {$ELSE}
8.  

and I would assume that I can keep on using ssleay32.dll / libeay32.dll even if a compile with Lazarus 2.2.4, am I right?

Is there any advantage to switching to libssl-1_1-x64.dll / libcrypto-1_1-x64.dll?

Thanks!

[domasz]

I read that this is a change from OpenSSL to LibreSSL and LibreSSL was made because of Heartbleed. So LibreSSL is more often updated and more secure.

[paweld]

The OpenSSL libraries from branch 1.0 (names: ssleay and libeay) are no longer supported as of 2019-12-30. The currently supported versions are 1.1.1 (names: libcrypto-1-1 and libssl-1-1) and 3.0 (names: libcrypto-3-0 and libssl-3-0).
DLL's from branch 1.0 can still be used, but it does not support TLS 1.3 and is not recommended for security reasons.