TLS libraries you actually link (2026)

The binary linked OpenSSL 1.1 because the image was old. Cryptography here is the library and the config, not a VPN. Network owns the path. The blog TLS guide stays the explainer.

Six libraries. One default. One Google fork. One Rust stack. One stdlib. One OpenBSD fork. One embedded shop. Public docs. Not a bake-off.

Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.

1

OpenSSL

Best for the library most images already link

OpenSSL · Apache-2.0

OpenSSL 3.x is Apache-2.0. It is still what a lot of distros ship. Config and version pin are the job.

Key features

• TLS 1.3
• FIPS stories they document
• Everywhere
• Apache-2.0 on 3.x

Why we like it

Start by naming the version you actually link. Then talk about rustls.

Limits

1.1.1 is not a current floor. Distro patches lag. Config errors are still yours.

2

BoringSSL

Best for google’s OpenSSL fork

Google · see repo

BoringSSL is Google’s fork. Chrome and some Google services use it. API is not a stable OpenSSL promise.

Key features

• Used at Google scale
• Aggressive removal of dead protocol
• You vendor it
• Not a distro default

Why we like it

If you already vendor BoringSSL, do not pretend it is stock OpenSSL.

Limits

Unstable API. Not a drop-in for every OpenSSL consumer. You own the upgrade.

3

rustls

Best for tLS in Rust without OpenSSL

rustls · Apache-2.0 / MIT / ISC

rustls is a TLS library in Rust. It does not link OpenSSL. Memory safety is the pitch. The repo is the prove-it.

Key features

• Pure Rust
• TLS 1.3
• Dual license
• Growing ecosystem

Why we like it

This is the hidden gem for new Rust services. You can name the crate in the lockfile.

Limits

Not every C ecosystem can switch. Some enterprise auditors still ask for OpenSSL FIPS.

4

Go crypto/tls

Best for stdlib TLS in Go

Go · BSD-3-Clause

Go’s crypto/tls is the stdlib. Most Go services already use it. Config is `MinVersion` and cipher policy.

Key features

• Stdlib
• TLS 1.3
• No extra link
• You set MinVersion

Why we like it

If the service is Go, start here. Do not add OpenSSL without a reason.

Limits

You still set a floor. Old `MinVersion` is a footgun. Not a WAF.

5

LibreSSL

Best for openBSD fork of OpenSSL

OpenBSD · see project

LibreSSL is the OpenBSD fork. Smaller surface is the pitch. Some BSDs and a few Linux ports use it.

Key features

• Fork focused on cleanup
• OpenBSD default story
• Compatible-ish APIs
• You choose the port

Why we like it

If the host is OpenBSD, this is the library you already have.

Limits

Linux support is a port, not a promise. Not the rustls story.

6

wolfSSL

Best for embedded TLS with a commercial path

wolfSSL · GPL-3.0 / commercial

wolfSSL targets embedded and FIPS shops. GPL or a commercial license.

Key features

• Small footprint story
• FIPS options they sell
• Lots of hardware hooks
• GPL or paid

Why we like it

When the device cannot take OpenSSL’s size, this is the commercial-friendly embedded row.

Limits

GPL in the device has a share story. Paid license is sales. Link OT if the device is a plant.

What the internet thinks about TLS libraries

rustls threads now talk about a compat shim, not a poster. Name the library you actually link.

tialaramex on Hacker News, Feb 2026: “There’s even a project for a deliberately OpenSSL drop-in compatible Rustls backed library.”

Prove you can name the library version

Print the OpenSSL version on the host you own. The number is the pin. Do not call a foreign server to ‘test TLS’ as a prove-it.

openssl version

FAQs

Is this a VPN list?

No. Network owns the path. This page is the library the service links.

Does TLS 1.3 on a poster mean I am done?

No. Name the library and the MinVersion you ship.

Should I roll my own TLS?

No. Empty was never a license to invent a handshake.

Is this a scored bake-off?

No. Order is editorial.