| single |
========================================================
pyOpenSSL -- A Python wrapper around the OpenSSL library
========================================================
:alt: Stable Docs
**Note:** The Python Cryptographic Authority **strongly suggests** the use
of `pyca/cryptography`_
where possible. If you are using pyOpenSSL for anything other than making a
TLS connection
**you should move to cryptography and drop your pyOpenSSL dependency**.
High-level wrapper around a subset of the OpenSSL library. Includes
* ``SSL.Connection`` objects, wrapping the methods of Python's portable
sockets
* Callbacks written in Python
* Extensive error-handling mechanism, mirroring OpenSSL's error codes
... and much more.
You can find more information in the documentation_.
Development takes place on GitHub_.
Discussion
==========
If you run into bugs, you can file them in our `issue tracker`_.
We maintain a cryptography-dev_ mailing list for both user and development
discussions.
You can also join ``#pyca on irc.libera.chat`` to ask questions or get
involved.
.. _documentation: https://pyopenssl.org/
.. _`issue tracker`: https://github.com/pyca/pyopenssl/issues
.. _cryptography-dev:
https://mail.python.org/mailman/listinfo/cryptography-dev
.. _GitHub: https://github.com/pyca/pyopenssl
.. _`pyca/cryptography`: https://github.com/pyca/cryptography
Release Information
===================
26.4.0 (2026-08-01)
-------------------
Backward-incompatible changes:
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Deprecations:
^^^^^^^^^^^^^
Changes:
^^^^^^^^
- Maximum supported cryptography version is now 50.x.
26.3.0 (2026-06-12)
-------------------
Backward-incompatible changes:
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
- Dropped support for Python 3.8.
- The minimum cryptography version is now 49.0.0.
- Removed deprecated ``OpenSSL.crypto.X509Req``,
``OpenSSL.crypto.dump_certificate_request``, and
``OpenSSL.crypto.load_certificate_request``. ``cryptography.x509`` should
be used instead.
- ``OpenSSL.SSL.Connection.set_session now raises ValueError if the Session
was obtained from a Connection that was using a different Context`` than
this one. OpenSSL requires (but does not verify) that sessions only be
re-used with a compatible SSL_CTX, so this contract is now enforced.
Deprecations:
^^^^^^^^^^^^^
- Deprecated ``OpenSSL.crypto.PKey.generate_key and
OpenSSL.crypto.PKey.check``. The key generation and loading APIs in
cryptography should be used instead.
- Deprecated ``OpenSSL.crypto.dump_privatekey``. The serialization APIs on
cryptography private key types should be used instead.
- Deprecated all the mutable APIs on ``OpenSSL.crypto.X509``: set_version,
set_pubkey, sign, set_serial_number, gmtime_adj_notAfter,
gmtime_adj_notBefore, set_notBefore, set_notAfter, set_issuer, and
set_subject. ``cryptography.x509.CertificateBuilder`` should be used
instead.
- Deprecated ``OpenSSL.SSL.Context.set_passwd_cb``. Users should decrypt
and load their private keys themselves, with cryptography's key loading
APIs, and then call ``OpenSSL.SSL.Context.use_privatekey``.
- Deprecated ``OpenSSL.crypto.X509Name``, as well as the remaining APIs
that consume or return it: ``OpenSSL.crypto.X509.get_issuer``,
``OpenSSL.crypto.X509.get_subject``, and
``OpenSSL.SSL.Context.set_client_ca_list``. The APIs in
``cryptography.x509`` should be used instead.
Changes:
^^^^^^^^
|