OpenSSL 4.1.0 is out. The headline feature is DTLS 1.3 support. You also get faster post-quantum algorithms, GREASE, and a handful of changes worth checking before you upgrade.
DTLS 1.3, with four known bugs
DTLS 1.3 is built on TLS 1.3 and protects traffic over datagram protocols such as UDP. OpenSSL's SSL listener API now speaks DTLS as well. The DTLS 1.3 guide in the OpenSSL documentation is a good starting point.
The implementation is not fully polished yet, though, and the project lists four known bugs. A server can abort the handshake with an unexpected_message alert if the client acknowledges messages from the first server flight before sending its own reply, which can happen after packet loss. After a KeyUpdate, OpenSSL also drops all other unacknowledged post-handshake messages from its retransmission buffer. If a NewSessionTicket gets lost at that point, the library does not send it again. The project is already working on a fix.
The other two bugs affect DTLS listeners. A permanent receive error can be reported as SSL_ERROR_WANT_READ, so applications just keep waiting. On non-blocking connections it can go the other way: a temporary write error may show up as SSL_ERROR_SYSCALL instead of SSL_ERROR_WANT_WRITE. If your application treats that as fatal, it may close a connection that was still perfectly usable.
GREASE, post-quantum speedups and IKEv2
GREASE according to RFC 8701 is new. It sprinkles reserved placeholder values into the TLS handshake, for example into the list of offered cipher suites. Nothing can actually be negotiated with them. The peer is supposed to ignore unknown offers instead of aborting the handshake, which keeps TLS implementations from breaking on future protocol extensions.
The post-quantum algorithms ML-DSA (digital signatures) and ML-KEM (key encapsulation for key agreement) got faster. On ppc64le both benefit, on x86_64 only ML-DSA does. Also on x86_64, there are new AVX-512 and VAES optimizations for AES-CBC decryption. On top of that comes a key derivation function for IKEv2, which turns the shared Diffie-Hellman secret into the keys the protocol needs.
What to check before upgrading
If you fetch timestamps with tsget, install the Perl module Net::Curl::Easy from the Net-Curl CPAN distribution first. It replaces the unmaintained WWW::Curl::Easy. And if you build OpenSSL yourself, you have to drop the Configure options no-ecdsa and no-ecdh, which never really disabled anything anyway. To turn off elliptic curve support entirely, use no-ec instead. The release notes for 4.1.0 list all changes and known issues.