Back
OpenSSL Win64 Installer Team
Patches for OpenSSL x64 EXE
Windows
3 patches available
The OpenSSL Installation Project is dedicated to providing a simple installation of OpenSSL for Microsoft Windows. It is easy to set up and easy to use through the simple, effective installer. No need to compile anything or jump through any hoops, just click a few times and it is installed, leaving you to doing real work.
OpenSSL x64 EXE Version 3.6.0
Release Date
10/1/2025
Bug Fix?
Yes
Minor Release?
Yes
Patch Notes
Changes between 3.5 and 3.6.0 [1 Oct 2025]$$$Added support for EVP_SKEY opaque symmetric key objects to the key derivation and key exchange provider methods. Added EVP_KDF_CTX_set_SKEY(); EVP_KDF_derive_SKEY(); and EVP_PKEY_derive_SKEY() functions.$$$$$$Added PCT for key import for SLH-DSA when in FIPS mode.$$$$$$Added i2d_PKCS8PrivateKey(3) API to complement i2d_PrivateKey(3); the former always outputs PKCS#8.$$$$$$Implemented interleaved AES-CBC+HMAC-SHA algorithm on AArch64.$$$$$$Added NIST security categories for PKEY objects.$$$$$$Added notification when all stream FINs are acknowledged in QUIC. Introduced ossl_quic_channel_notify_flush_done() so that once final FINs are ACKed; the channel transitions to terminating and SSL_poll() signals completion. This allows applications to progress shutdown reliably.$$$$$$Added array memory allocation routines and converted suitable memory allocation calls in the library to them.$$$$$$Fixed behavior change of EC keygen by adding the generic error entry if the provider did not itself add an error entry onto the queue. That way; there always is an error on the error queue in case of a failure; but no behavior change in case the provider emitted the error entry itself.$$$$$$Documented all the environment variables used across the project in openssl-env(7) and in specific man pages.$$$$$$Added SHA-2 assembly implementation enhancing performance for LoongArch. Added optimized SM3; MD5; SHA-256; SHA-512 implementation using Zbb extension for RISC-V.$$$$$$Added options CRYPTO_MEM_SEC and CRYPTO_MEM_SEC_MINSIZE to openssl app to initialize secure memory at the beginning of openssl app.$$$$$$Resolved compiler warnings on Win64 builds.$$$$$$Extended new CRYPTO_THREAD_[get|set]_local API to reduce the usage of OS thread-local variables.$$$$$$Added make targets build_inst_sw and build_inst_programs which have the functionality to split the build into two parts; e.g. when tests should be built with different compiler flags than the installed software.$$$$$$Refactored OSSL_PARAM name parsing so that automatically generated parsers are used instead of OSSL_PARAM_locate() calls. This should also ensure that the list of acceptable parameters better matches those which are actually processed. It should also provide a small performance improvement; because repeated iteration over passed parameter arrays is avoided.$$$$$$Introduced SSL_OP_SERVER_PREFERENCE; superseding misleadingly named SSL_OP_CIPHER_SERVER_PREFERENCE.$$$$$$Added LMS signature verification support as per SP 800-208. This support is present in both the FIPS and default providers.$$$$$$Introduced use of <stdbool.h> when handling JSON encoding in the OpenSSL codebase; replacing the previous use of int for these boolean values.$$$$$$An ANSI-C toolchain is no longer sufficient for building OpenSSL. The code should be built using compilers supporting C-99 features.$$$$$$Support for the VxWorks platforms has been removed. These platforms were unadopted; unmaintained and reported to be non-functional.$$$$$$Relaxed the path check in OpenSSLs file: scheme implementation for OSSL_STORE. Previously; when the file: scheme is an explicit part of the URI; our implementation required an absolute path; such as file:/path/to/file.pem. This requirement is now relaxed; allowing file:path/to/file.pem; as well as file:file.pem.$$$$$$Changed openssl-pkey(1) to match the documentation when private keys are output in DER format (-outform DER) by producing the PKCS#8 form by default. Previously; this would output the traditional form for those older key types (DSA; RSA; ECDSA) that had such a form. The -traditional flag has been extended to support explicit requests to output that format in DER format (it was previously PEM-only).$$$$$$Added an openssl configutl utility for processing the OpenSSL configuration file and dumping the equal configuration file.$$$$$$Added support for setting a free function thunk to OPENSSL_sk stack types. Using a thunk allows the type specific free function to be called with
OpenSSL x64 EXE Version 3.4.0
Release Date
10/22/2024
Bug Fix?
Yes
Minor Release?
Yes
Patch Notes
Major changes between OpenSSL 3.3 and OpenSSL 3.4.0 [22 Oct 2024]$$$OpenSSL 3.4.0 is a feature release adding significant new functionality to OpenSSL.$$$$$$This release incorporates the following potentially significant or incompatible changes:$$$$$$Deprecation of TS_VERIFY_CTX_set_* functions and addition of replacement TS_VERIFY_CTX_set0_* functions with improved semantics$$$$$$Redesigned use of OPENSSLDIR/ENGINESDIR/MODULESDIR on Windows such that what were formerly build time locations can now be defined at run time with registry keys$$$$$$
OpenSSL x64 EXE Version 3.4.0
Release Date
10/22/2024
Bug Fix?
Yes
Minor Release?
Yes
Patch Notes
Major changes between OpenSSL 3.3 and OpenSSL 3.4.0 [22 Oct 2024]$$$OpenSSL 3.4.0 is a feature release adding significant new functionality to OpenSSL.$$$$$$This release incorporates the following potentially significant or incompatible changes:$$$$$$Deprecation of TS_VERIFY_CTX_set_* functions and addition of replacement TS_VERIFY_CTX_set0_* functions with improved semantics$$$$$$Redesigned use of OPENSSLDIR/ENGINESDIR/MODULESDIR on Windows such that what were formerly build time locations can now be defined at run time with registry keys$$$$$$
OpenSSL x64 EXE Version 3.4.0
Release Date
10/22/2024
Bug Fix?
Yes
Minor Release?
Yes
Patch Notes
Major changes between OpenSSL 3.3 and OpenSSL 3.4.0 [22 Oct 2024]$$$OpenSSL 3.4.0 is a feature release adding significant new functionality to OpenSSL.$$$$$$This release incorporates the following potentially significant or incompatible changes:$$$$$$Deprecation of TS_VERIFY_CTX_set_* functions and addition of replacement TS_VERIFY_CTX_set0_* functions with improved semantics$$$$$$Redesigned use of OPENSSLDIR/ENGINESDIR/MODULESDIR on Windows such that what were formerly build time locations can now be defined at run time with registry keys$$$$$$
OpenSSL x64 EXE Version 3.4.0
Release Date
10/22/2024
Bug Fix?
Yes
Minor Release?
Yes
Patch Notes
Major changes between OpenSSL 3.3 and OpenSSL 3.4.0 [22 Oct 2024]$$$OpenSSL 3.4.0 is a feature release adding significant new functionality to OpenSSL.$$$$$$This release incorporates the following potentially significant or incompatible changes:$$$$$$Deprecation of TS_VERIFY_CTX_set_* functions and addition of replacement TS_VERIFY_CTX_set0_* functions with improved semantics$$$$$$Redesigned use of OPENSSLDIR/ENGINESDIR/MODULESDIR on Windows such that what were formerly build time locations can now be defined at run time with registry keys$$$$$$
OpenSSL x64 EXE Version 3.4.3
Release Date
9/30/2024
Bug Fix?
Yes
Minor Release?
Yes
Patch Notes
Changes between 3.5.3 and 3.5.4 [30 Sep 2025]$$$Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap$$$$$$Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write.$$$$$$Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code.$$$$$$The issue was reported by Stanislav Fort (Aisle Research).$$$$$$(CVE-2025-9230)$$$$$$Viktor Dukhovni$$$$$$Fix Timing side-channel in SM2 algorithm on 64 bit ARM$$$$$$Issue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementation on 64 bit ARM platforms.$$$$$$Impact summary: A timing side-channel in SM2 signature computations on 64 bit ARM platforms could allow recovering the private key by an attacker.$$$$$$The issue was reported by Stanislav Fort (Aisle Research).$$$$$$(CVE-2025-9231)
Interested in automating patching for OpenSSL x64 EXE?