There are plenty of comparisons but most of then for older versions of OpenSSL. Apparently OpenSSL fixed a lots of infamous vulnerabilities, cleaned up code and build process.

So my question is, as of today (OpenSSL 1.1.1d), how does OpenSSL and BoringSSL compares? Would you move from BoringSSL to OpenSSL ?

  • Is Google actually using BoringSSL? LibreSSL devs (OpenBSD) are actually serious about using theirs, so they switched to it for their OS. – user Sep 17 at 17:34
  • @user: BoringSSL is the SSL stack of Android and of Chrome browser. – Steffen Ullrich Sep 17 at 18:07
  • @SteffenUllrich Nice. I've updated my answer with that information. I'm used to large companies releasing some nice technology and just letting it die (Microsoft mostly). – user Sep 17 at 18:10

According to Google's own source code repository, BoringSSL is not intended for general use and the programming interface is not stable. They are, however, using it for both Android and the Chrome browser. I personally would not use it in my own products because the interfaces are not stable. Cloudflare seems to be using it, but they have more resources to dedicate to updating to new APIs when BoringSSL updates than I do.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.