From f90790197e26e0c55d74a371b061c768a7193056 Mon Sep 17 00:00:00 2001 From: Davis Goodin Date: Wed, 28 Oct 2026 09:33:02 -0700 Subject: [PATCH 1/2] doc: update OpenSSL 4 support details --- eng/doc/SupportedPlatforms.md | 1 + eng/doc/fips/README.md | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/eng/doc/SupportedPlatforms.md b/eng/doc/SupportedPlatforms.md index 124334b5bf2..6fa1696f042 100644 --- a/eng/doc/SupportedPlatforms.md +++ b/eng/doc/SupportedPlatforms.md @@ -29,6 +29,7 @@ The following OpenSSL versions are supported on Linux platforms: - OpenSSL 1.1.1 - OpenSSL 3.x (built-in providers, or SymCrypt provider v1.6.1+) +- OpenSSL 4.x (built-in providers, or SymCrypt provider v1.6.1+) (since Go 1.28) ## Getting Help diff --git a/eng/doc/fips/README.md b/eng/doc/fips/README.md index 1aca7e11bc4..6331a02506c 100644 --- a/eng/doc/fips/README.md +++ b/eng/doc/fips/README.md @@ -327,6 +327,7 @@ The `libcrypto` shared library file name varies among different platforms, so a - The base name is always `libcrypto.so.` - Well-known version strings are appended to the base name in this order: + - Since Go 1.28: `3` -> `4` -> `1.1` -> `11` -> `111`. - Since Go 1.25: `3` -> `1.1` -> `11` -> `111`. - Prior to Go 1.25: `3` -> `1.1` -> `11` -> `111` -> `1.0.2` -> `1.0.0`. - This may find multiple libraries installed on the machine, so to pick one: @@ -461,6 +462,11 @@ A program running in FIPS mode can claim it is using a FIPS-certified cryptograp This list of major changes is intended for quick reference and for access to historical information about versions that are no longer supported. The behavior of all in-support versions are documented in the sections above with notes for version-specific differences where necessary. +### Go 1.28 (Feb 2027) + +- The OpenSSL backend supports OpenSSL 4. + - The preference when discovering the OpenSSL version to use is the first match of: `3` -> `4` -> `1.1` -> `11` -> `111`. + ### Go 1.27 (Aug 2026) - Support for `GODEBUG=fips140=only` has been added. It acts as `fips140=on`, but also panics if a non-FIPS-approved algorithm is used. From 9d0c6b04c58680c9b5fc0dcdf33ae00cd4c47864 Mon Sep 17 00:00:00 2001 From: Davis Goodin Date: Wed, 28 Oct 2026 09:51:57 -0700 Subject: [PATCH 2/2] Remove duplicate OpenSSL preference list --- eng/doc/fips/README.md | 1 - 1 file changed, 1 deletion(-) diff --git a/eng/doc/fips/README.md b/eng/doc/fips/README.md index 6331a02506c..d6bf6ac0d1a 100644 --- a/eng/doc/fips/README.md +++ b/eng/doc/fips/README.md @@ -465,7 +465,6 @@ This list of major changes is intended for quick reference and for access to his ### Go 1.28 (Feb 2027) - The OpenSSL backend supports OpenSSL 4. - - The preference when discovering the OpenSSL version to use is the first match of: `3` -> `4` -> `1.1` -> `11` -> `111`. ### Go 1.27 (Aug 2026)