The pre-3.0 OpenSSL terms are two BSD-style licenses with advertising clauses, and they are GPL-incompatible. OpenSSL 3.0 moved to Apache-2.0.
On this page
What it does
The OpenSSL License is the pre-3.0 licensing of OpenSSL, and it is two texts at once: the OpenSSL License and the original SSLeay License, both written in the BSD-4-Clause style. Permissive in the ordinary sense, so you can ship the code inside a closed product. Both texts carry an advertising clause. Advertising material that mentions features of the software has to acknowledge the OpenSSL Project, and the SSLeay half asks for credit to Eric Young. OpenSSL 3.0 and later moved to Apache-2.0, which drops all of this.
Details
The advertising clauses make this license incompatible with the GPL. That is why thousands of GPL projects carry an explicit OpenSSL exception in their own headers. If your product combines OpenSSL-licensed code with GPL code and no exception is written down, that is a real problem to resolve, not a paperwork item. The smaller clause is still live: your marketing has to credit the OpenSSL Project when it names the crypto features. Check the version first, because 3.0 and later are Apache-2.0 and none of this applies.
Pros
- Easy to drop into a closed, paid product. Procurement has seen this family hundreds of times.
- No copyleft on your own files. You keep your source private.
Cons
- The notice duty is easy to miss in a desktop, mobile, or container build. A web page is not a substitute for notices inside the artifact.
- Buyers who want an express patent grant will ask you to prefer Apache-2.0 over a short MIT-style text.
What it allows and requires
Choose a category to see the full grant in one scannable list. Permissions show what the license allows, limits show what it withholds, and obligations show the conditions your release process must satisfy.
Permissions
Commercial use
You may ship the code inside a paid product. The license does not restrict commercial use.
Modify
You may change the code, including keeping those changes private, unless a later obligation says otherwise.
Distribute
You may give copies to others. Distribution is what usually turns notice and source duties into real work.
Sublicense
You may include the code under your own product terms, so long as you still meet this license's conditions.
Private use
Use inside your company, including internal forks, does not by itself trigger distribution duties.
Limits
Hold liable
The authors disclaim warranty. Recipients cannot hold them liable for damages arising from the software, except where law forbids that disclaimer.
Use trademark
The license is not a trademark license. Names, logos and product marks stay with their owners unless a separate grant says otherwise.
Patent grant
The text does not grant patents. If buyers want an express patent grant, Apache-2.0 is the usual alternative.
OpenSSL vs Apache
Classic OpenSSL advertising terms differ from Apache-2.0. New OpenSSL releases moved; record the text that actually shipped.
Obligations
Include copyright
Keep the copyright line with every copy or substantial portion you distribute.
Include license
Keep the license text with every copy or substantial portion you distribute. A web page is not a substitute for notices inside a shipped artifact.
Give credit
Advertising materials must include the acknowledgment the license names.
What OpenSSL requires when you ship
When a copy that includes OpenSSL code leaves your company, the grant is broad and the paperwork is easy to miss. Distribution here means an installer, a mobile binary, a container image, or an SDK another team embeds. Work this list against the artifact you actually hand over, not against a README. A hosted service that never gives out a copy still belongs on the record, but the notice duty does not fire until a copy exists.
You are meeting the notice condition when both texts, the OpenSSL License and the SSLeay License, ship with every copy you distribute.
You are meeting the advertising clauses when material that mentions the software's features acknowledges the OpenSSL Project and credits Eric Young.
You have settled the GPL question when either no GPL code sits in the same product, or the GPL component carries a written OpenSSL exception.
You may have no duty here at all when the component is really OpenSSL 3.0 or later, which ships under Apache-2.0. Confirm the version before copying the old text.
The duties named in OpenSSL
The license text itself is short. These are the named conditions. They follow the code, including files you vendor into your own repository and transitive packages in the lockfile.
Include copyright
Keep the copyright line with every copy or substantial portion you distribute.
Include license
Keep the license text with every copy or substantial portion you distribute. A web page is not a substitute for notices inside a shipped artifact.
Give credit
Advertising materials must include the acknowledgment the license names.
Things to be aware of
- Teams copy only the OpenSSL half of the text. The package carries two licenses, and the SSLeay half has its own copyright line and its own advertising clause.
- The GPL incompatibility surfaces during a customer's review instead of your own. Search your inventory for GPL components in the same product early.
- An old OpenSSL identifier is left on a component that has since moved to Apache-2.0. Confirm the shipped version, then fetch the license text again.
- The advertising clause is read as covering only printed ads. Treat a feature page, a release post, or a store listing as advertising material too.
What the OpenSSL License does not do
Search results often flatten OpenSSL License into a slogan. These are the usual misreads. OpenSSL is a grant with conditions, not a permission to skip the paperwork below.
- the OpenSSL License does not require you to publish your own source. Combining it with closed code is the point of the grant.
- the OpenSSL License does not mean "no obligations." The copyright line and license text still have to travel with copies you hand to other people.
- It is not a patent license unless the text says so. MIT-family grants say nothing about patents.
How OpenSSL differs from nearby licenses
These licenses are often confused with OpenSSL, but their release duties differ. Each row summarizes what the license requires when you ship. Open the linked page for the full checklist.
- OpenSSL
- The pre-3.0 OpenSSL terms are two BSD-style licenses with advertising clauses, and they are GPL-incompatible. OpenSSL 3.0 moved to Apache-2.0.
- Apache-2.0
- Permissive like MIT, plus an express patent grant. The catch is the NOTICE file: it has to travel inside the binaries you ship.
- BSD-3-Clause
- Permissive like MIT, with one extra rule: you may not use the authors' names to promote your product. Notices travel with source and binaries.
- GPL-2.0-or-later
- GPL-2.0 asks for source when you hand someone a binary. Running it on your own servers triggers nothing. The trigger is shipping a copy, not merely using it.
Common questions about OpenSSL License
Answers to common questions about what OpenSSL License requires, when its duties apply, and what evidence belongs with a release.
What is the OpenSSL License?
The OpenSSL License is the pre-3.0 licensing of OpenSSL, and it is two texts at once: the OpenSSL License and the original SSLeay License, both written in the BSD-4-Clause style. Permissive in the ordinary sense, so you can ship the code inside a closed product. Both texts carry an advertising clause. Advertising material that mentions features of the software has to acknowledge the OpenSSL Project, and the SSLeay half asks for credit to Eric Young. OpenSSL 3.0 and later moved to Apache-2.0, which drops all of this.
What does OpenSSL require when you ship a product?
You are meeting the notice condition when both texts, the OpenSSL License and the SSLeay License, ship with every copy you distribute. You are meeting the advertising clauses when material that mentions the software's features acknowledges the OpenSSL Project and credits Eric Young. You have settled the GPL question when either no GPL code sits in the same product, or the GPL component carries a written OpenSSL exception. You may have no duty here at all when the component is really OpenSSL 3.0 or later, which ships under Apache-2.0. Confirm the version before copying the old text.
Does OpenSSL require me to open my own source?
It is not a patent license unless the text says so. MIT-family grants say nothing about patents.
How do I attribute OpenSSL in a product I ship?
Attribution for OpenSSL means the copyright line and the license text travel with every copy a recipient actually gets. That can be an about screen, a licenses file inside the installer, or a notice in the container image. A public page helps a buyer audit the inventory. It does not replace notices inside the artifact. If you copied files into your own repository, the header on those files still has to stay.
Is a website notice enough for OpenSSL?
No. OpenSSL talks about copies. A public attestation page is the honest list for procurement. The condition is met when the notices sit in the material you hand over. Put them in the installer, the about screen, or a licenses file inside the binary, then keep the same texts on the page.
Do transitive OpenSSL dependencies count?
Yes. The condition follows the code, not the package you chose by name. If the lockfile pulled in OpenSSL transitively and you distribute that tree, those notices travel too. Listing only direct dependencies is how teams miss the duty.
How is OpenSSL different from Apache License 2.0?
OpenSSL asks this: The pre-3.0 OpenSSL terms are two BSD-style licenses with advertising clauses, and they are GPL-incompatible. OpenSSL 3.0 moved to Apache-2.0. Apache License 2.0 asks this: Permissive like MIT, plus an express patent grant. The catch is the NOTICE file: it has to travel inside the binaries you ship. Open the Apache License 2.0 page for what that license requires when you ship. Do not treat the SPDX ids as interchangeable because the short names look similar.
Where do I record OpenSSL for a buyer?
SourceTrust fetches the published artifact, extracts the license files, and compares them against the declared SPDX id. A package that carries both the OpenSSL and SSLeay texts keeps both on the component record. That record is what the attestation page shows and what every export file repeats, generated from the frozen published snapshot rather than live data. SourceTrust does not tell you whether two licenses in your product fit together, so the GPL question stays a human one.
Where do I record OpenSSL for a buyer?
SourceTrust fetches the published artifact, extracts the license files, and compares them against the declared SPDX id. A package that carries both the OpenSSL and SSLeay texts keeps both on the component record.
That record is what the attestation page shows and what every export file repeats, generated from the frozen published snapshot rather than live data. SourceTrust does not tell you whether two licenses in your product fit together, so the GPL question stays a human one.
Read /docs/export-sbom for the formats.
See also
The hub is the pillar for this cluster. Sibling licenses are the other spokes. Product FAQ links explain how SourceTrust records the duty, not the license text itself.
Practical guidance for procurement review, not legal advice. Confirm high-stakes use with counsel.