openssl/doc, branch openssl-4.0

doc: RAND(7): a restore from a saved image is not detected; reseed after it

2026-10-23T12:52:13Z

The DRBGs reseed on a change of process ID, on the request count and on the time interval, and have no way to notice that the process or the machine was restored from a snapshot or a checkpoint: copies restored from one image continue from the same state until their next scheduled reseed. Say so in RAND(7) beside the paragraph on automatic reseeding, and tell applications in such environments to reseed after their own restore signal, with RAND_poll(3) as the call that does it. Measured on 3.5.9 and master: two continuations of one QEMU or Firecracker snapshot, or of one CRIU checkpoint, print identical RAND_bytes output block for block (32 of 32, 14 of 14) until the primary DRBG's interval expires; plain fork, _Fork and clone are distinct through the pid check. Assisted-by: Claude Code:claude-fable-5-1 Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale Reviewed-by: Viktor Dukhovni Merge-date: Fri Oct 23 12:51:55 2026 Merged-from: https://github.com/openssl/openssl/pull/33285 (cherry picked from commit f4ada04e0c795e3ff07aa24be79b7240cfbf3388)

Document the OSSL_PARAM_merge() entry limit

2026-10-23T12:48:01Z

OSSL_PARAM_merge() only considers the first 128 entries of each input array and silently ignores the rest. Mention this in the manual page. Signed-off-by: Martin Mirchev Assisted-by: Claude Code:claude-opus-5-5 Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale Reviewed-by: Shane Lontis Merge-date: Fri Oct 23 12:47:50 2026 Merged-from: https://github.com/openssl/openssl/pull/33244 (cherry picked from commit 25bba416c07ca811f99d2602ca7e7e6fbd43c45a)

doc: replace DES-EDE3-CBC with AES-256-CBC in PEM examples

2026-10-23T12:45:05Z

The EXAMPLES section of PEM_read_bio_PrivateKey still showed EVP_des_ede3_cbc() for encrypting private keys, but 3DES is deprecated in OpenSSL 3.x. Replace with EVP_aes_256_cbc() to show a modern cipher, consistent with other man pages. The DEK-Info header in the file format example is left as-is since it documents the actual PEM file structure. Fixes #28665 CLA: trivial Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale Reviewed-by: Shane Lontis Merge-date: Fri Oct 23 12:44:52 2026 Merged-from: https://github.com/openssl/openssl/pull/33228 (cherry picked from commit 1b02949afd9ddba89ef4f133ecb3c4e9de8c223d)

doc/man3/EC_GROUP_new.pod: document EC_GROUP_get_ecpkparameters function

2026-10-18T15:32:06Z

Added EC_GROUP_get_ecpkparameters() function description and usage details. Complements: 60b350a3ef96 "RT3676: Expose ECgroup i2d functions" Reviewed-by: Jakub Zelenka Reviewed-by: Frederik Wedel-Heinen Reviewed-by: Eugene Syromiatnikov Merge-date: Sun Oct 18 15:26:52 2026 Merged-from: https://github.com/openssl/openssl/pull/32169 (cherry picked from commit f7b2254eeebdc68bd4e57a3147606590b8188ab1)

crypto/x509/x509_lu.c: avoid freeing X509_OBJECTs in X509_STORE_get0_objects()

2026-10-13T13:50:36Z

The implementation of hash table conversion in commit 04589b59ef50 "x509store: reduce lock contention in X509_STORE" introduced a potential use-after-free condition when X509_STORE_get0_objects() is called during X.509 verification. Avoid that by re-using existing X509_OBJECTs instead of duplicating them. Resolves: https://github.com/openssl/openssl/issues/33063 Fixes: 04589b59ef50 "x509store: reduce lock contention in X509_STORE" Signed-off-by: Eugene Syromiatnikov Reviewed-by: Mounir Idrassi Reviewed-by: Nikola Pajkovsky Merge-date: Tue Oct 13 13:45:39 2026 Merged-from: https://github.com/openssl/openssl/pull/33147 (cherry picked from commit b86b1098fd7ec47e1c9d43a7566bf4e287b1d390)

Correct PEM X509 docs regarding TRUSTED CERTIFICATE blocks

2026-10-11T21:37:15Z

The documentation stated that the X509 PEM functions also process trusted certificates, discarding the trust settings. In fact, they reject "TRUSTED CERTIFICATE" blocks; only the X509_AUX functions accept them. Update the text accordingly. Resolves: https://github.com/openssl/openssl/issues/33019 CLA: trivial Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz Merge-date: Sun Oct 11 21:31:53 2026 Merged-from: https://github.com/openssl/openssl/pull/33166 (cherry picked from commit 22d309a11839d7c505af63c54880e657fc4bab5c)

Fix up OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR history documentation

2026-10-10T16:03:27Z

The OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR has been actually added in commit 7960dbec6801 " Certificate Management Protocol (CMP, RFC 4210) extension to OpenSSL Also includes CRMF (RFC 4211) and HTTP transfer (RFC 6712)", commit e7d5206e892e "apps/cmp.c: add -ta_in_ip_extracerts permitting non-authenticated trust anchors in IP extracerts according to 3GPP TS 33.310" has only wired up in the openssl command; correct the HISTORY section in doc/man3/OSSL_CMP_CTX_new.pod and the entry in CHANGES.md accordingly. Fixes: cdad6573efed "add HISTORY and CHANGES.md entry for OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR introduced in 4.0" Reported-by: Tomas Mraz Signed-off-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz Reviewed-by: David von Oheimb Reviewed-by: Norbert Pocs Merge-date: Sat Oct 10 16:03:47 2026 Merged-from: https://github.com/openssl/openssl/pull/33144

add HISTORY and CHANGES.md entry for OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR introduced in 4.0

2026-10-10T16:03:27Z

Complements: 21722fe5545c "OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR: use new TA(s) for whole transaction (also pkiconf); update doc" Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz Merge-Date: Thu Jun 11 14:56:47 2026 Original-PR: https://github.com/openssl/openssl/pull/29043 Reviewed-by: Norbert Pocs Merged-from: https://github.com/openssl/openssl/pull/33144

Fix typos

2026-10-09T18:38:14Z

Found by typos[1]. [1] https://github.com/crate-ci/typos CLA: trivial Reviewed-by: Shane Lontis Reviewed-by: Paul Dale Reviewed-by: Tim Hudson Reviewed-by: Norbert Pocs Reviewed-by: Eugene Syromiatnikov MergeDate: Wed Jul 8 10:46:01 2026 Original-PR: https://github.com/openssl/openssl/pull/31858 Reviewed-by: Daniel Kubec Reviewed-by: Kurt Roeckx Merged-from: https://github.com/openssl/openssl/pull/33143

fix typo (s/suppresion/suppression)

2026-10-07T15:40:38Z

Fixes: 817c105ec63b "doc/man7/openssl_user_macros.pod.in: document OPENSSL_SUPPRESS_DEPRECATED" Reviewed-by: Matt Caswell Reviewed-by: Kurt Roeckx Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz Merge-date: Wed Oct 7 15:39:22 2026 Merged-from: https://github.com/openssl/openssl/pull/33137 (cherry picked from commit e5acfe01b7615705ef9aa4cc78882ff4f3362858)