OpenSSL 4.0.0 is a feature release adding significant new functionality
This release incorporates the following potentially significant or incompatible
Removed extra leading '00:' when printing key data such as an RSA modulus
Standardized the width of hexadecimal dumps to 24 bytes for signatures
Lower bounds checks are now enforced when using PKCS5_PBKDF2_HMAC API
Added AKID verification checks when X509_V_FLAG_X509_STRICT is set.
Augmented CRL verification process with several additional checks.
libcrypto no longer cleans up globally allocated data via atexit().
BIO_snprintf() now uses snprintf() provided by libc instead of internal
OPENSSL_cleanup() now runs in a global destructor, or not at all
ASN1_STRING has been made opaque.
Signatures of numerous API functions, including those that are related
Deprecated X509_cmp_time(), X509_cmp_current_time(),
Removed support for the SSLv2 Client Hello.
Removed support for SSLv3. SSLv3 has been deprecated since 2015,
Removed support for engines. The no-engine build option
Support of deprecated elliptic curves in TLS according to RFC 8422 was
Support of explicit EC curves was disabled at compile-time by default.
Removed c_rehash script tool. Use openssl rehash instead.
Removed the deprecated msie-hack option from the openssl ca command.
Removed BIO_f_reliable() implementation without replacement.
Removed deprecated support for custom EVP_CIPHER, EVP_MD, EVP_PKEY,
Removed deprecated fixed SSL/TLS version method functions.
Removed deprecated functions ERR_get_state(), ERR_remove_state()
Dropped darwin-i386{,-cc} and darwin-ppc{,64}{,-cc} targets
This release adds the following new features:
Support for Encrypted Client Hello (ECH, RFC 9849).
Support for RFC 8998, signature algorithm sm2sig_sm3, key exchange
cSHAKE function support as per SP 800-185.
"ML-DSA-MU" digest algorithm support.
Support for SNMP KDF and SRTP KDF.
FIPS self tests can now be deferred and run as needed when installing
Support for using either static or dynamic VC runtime linkage
Support for negotiated FFDHE key exchange in TLS 1.2 in accordance