# OpenSSL 48 Hacker News commenters recommended OpenSSL and 98 criticized it, November 2025 to November 2026. It was recommended in 10 of 13 months. **Verdict:** Widely used TLS library that people rely on for secure connections; performance has improved, though its design, bug history and confusing API draw frequent criticism. ## Why people recommend it - Performance much improved since OpenSSL 3 (3 comments): "Not back to 1.1.1 levels of performance, but enough that it's probably not a dealbreaker for most people." ([source](https://news.ycombinator.com/item?id=50211649)) "There were massive improvements to performance in some of the areas criticized by PyCA and haproxy." ([source](https://news.ycombinator.com/item?id=50213832)) "Compared to other things on the internet, it doesn't cause that much of a slow down." ([source](https://news.ycombinator.com/item?id=47775416)) - Default choice among crypto libraries (3 comments): "Use JWT tokens and OpenSSL or another established library to sign them." ([source](https://news.ycombinator.com/item?id=47775736)) "please just use OpenSSL or another similar major crypto library" ([source](https://news.ycombinator.com/item?id=48029947)) "For those two things, OpenSSL is fine as it is." ([source](https://news.ycombinator.com/item?id=46484187)) - Protects privacy and secure communications (2 comments): "providing a safety net when our politicians decide to tighten their grip on privacy and secure communications" ([source](https://news.ycombinator.com/item?id=46087217)) "is of prime importance to those operating Internet-accessible servers, or clients" ([source](https://news.ycombinator.com/item?id=47770575)) ## What people warn about - Complex, confusing API and code (5 comments): "OpenSSL is documentation is very complete, very thorough, but also completely opaque" ([source](https://news.ycombinator.com/item?id=46598505)) "Now you're constructing OSSL_PARAM arrays, looking up providers by string name, and hoping you got the key type right because nothing checks at compile time." ([source](https://news.ycombinator.com/item?id=47772538)) "I found that the OpenSSL source code was so complex that I would have spent a lot more time discussing the intricacies of the C code itself" ([source](https://news.ycombinator.com/item?id=46633623)) - Recurring bugs from weak processes (4 comments): "OpenSSL and other similar security substandard projects have process deficiencies that lead to similar bugs over and over again." ([source](https://news.ycombinator.com/item?id=46785639)) "OpenSSL's CI is exceptionally flaky, and the OpenSSL project has grown to tolerate this flakiness, which masks serious bugs." ([source](https://news.ycombinator.com/item?id=47773266)) "a significant fraction of OpenSSL bugs could be prevented if they just used a small library for managing buffers" ([source](https://news.ycombinator.com/item?id=46715962)) - Slow performance, especially in TLS (4 comments): "Openssl 3.0, which was the version in the official packages of our LTS distro was unacceptably slow." ([source](https://news.ycombinator.com/item?id=50217457)) "Technically yes, OpenSSL 3.X is slow, measurably so, but not enough that we wanted to deal with it." ([source](https://news.ycombinator.com/item?id=50211304)) "the design of OpenSSL 3.0 was a major step backwards, not least for performance" ([source](https://news.ycombinator.com/item?id=47770624)) - Breaking updates and compatibility churn (3 comments): "The number of updates that fixed a critical security problem but needed application changes to work was pretty high." ([source](https://news.ycombinator.com/item?id=46767866)) "OpenSSL has historically been crap with respect to development compatability" ([source](https://news.ycombinator.com/item?id=46628628)) "i think a project like this would slough old architecture like mad and let major versions tick, but they forge on" ([source](https://news.ycombinator.com/item?id=50208869)) ## Alternatives hackers recommend - [LibreSSL](https://hackerapproved.com/p/libressl.md): 11 recommend ## Cite as Hacker Approved, "OpenSSL", https://hackerapproved.com/p/openssl/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).