GeezerVison

This article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these messages) A major contributor to this article appears to have a close connection with its subject. It may require cleanup to comply with Wikipedia's content policies, particularly neutral point of view. Please discuss further on the talk page. See our advice if the article is about you and read our scam warning in case someone asks for money to edit this article. (November 2020) (Learn how and when to remove this message) The topic of this article may not meet Wikipedia's notability guidelines for products and services. Please help demonstrate the notability of the topic by citing reliable secondary sources that are independent of the topic and provide significant coverage of it beyond a mere trivial mention. If notability cannot be shown, the article is likely to be merged, redirected, or deleted. Find sources: "WolfSSL" – news · newspapers · books · scholar · JSTOR (August 2025) (Learn how and when to remove this message) (Learn how and when to remove this message)

wolfSSL
Developer	Todd Ouska
Release	February 19, 2006 (2006-02-19)[1]
Stable release	5.9.4[2]  / 27 September 2026
Written in	C
Operating system	Multi-platform
Type	Cryptography library
License	GPL-3.0-or-later or proprietary[3]
Website	www.wolfssl.com
Repository	github.com/wolfssl/wolfssl

wolfSSL is a small, portable, embedded SSL/TLS library targeted for use by embedded systems developers. It is an open source implementation of TLS (SSL 3.0, TLS 1.0, 1.1, 1.2, 1.3, and DTLS 1.0, 1.2, and 1.3) written in the C programming language. It includes SSL/TLS client libraries and an SSL/TLS server implementation as well as support for multiple APIs, including those defined by SSL and TLS. wolfSSL also includes an OpenSSL compatibility interface with the most commonly used OpenSSL functions.^[4][5]

wolfSSL is currently available for Microsoft Windows, Linux, macOS, Solaris, ESP32, ESP8266, ThreadX, VxWorks, FreeBSD, NetBSD, OpenBSD, embedded Linux, Yocto Project, OpenEmbedded, WinCE, Haiku, OpenWrt, iPhone, Android, Wii, and GameCube through DevKitPro support, QNX, MontaVista, Tron variants, NonStop OS, OpenCL, Micrium's MicroC/OS-II, FreeRTOS, SafeRTOS, Freescale MQX, Nucleus, TinyOS, TI-RTOS, HP-UX, uTasker, uT-kernel, embOS, INtime, mbed, RIOT, CMSIS-RTOS, FROSTED, Green Hills INTEGRITY, Keil RTX, TOPPERS, PetaLinux, Apache Mynewt, and PikeOS,^[6] Deos, Azure Sphere OS, Zephyr, AIX, and Cesium.

The genesis of wolfSSL dates to 2004. OpenSSL was available at the time, and was dual licensed under the OpenSSL License and the SSLeay license.^[7] yaSSL, alternatively, was developed and dual-licensed under both a commercial license and the GPL.^[8] yaSSL offered a more modern API, commercial style developer support and was complete with an OpenSSL compatibility layer.^[4] The first major user of wolfSSL/CyaSSL/yaSSL was MySQL.^[9] Through bundling with MySQL, yaSSL has achieved extremely high distribution volumes in the millions.

In February 2019, Daniel Stenberg, the creator of cURL, was hired by the wolfSSL project to work on cURL.^[10]

The wolfSSL lightweight SSL library implements the following protocols:^[11]

• SSL 3.0, TLS 1.0, TLS 1.1, TLS 1.2, TLS 1.3
• DTLS 1.0, DTLS 1.2, DTLS 1.3
• Extensions: Server Name Indication (SNI), Maximum Fragment Length, Truncated HMAC, Application Layer Protocol Negotiation (ALPN), Extended Master Secret, Supported Elliptic Curves
• Ciphersuites: TLS Secure Remote Password, TLS Pre-Shared Key
• Post-quantum cryptography: ML-DSA added to sigAlgs, ML-KEM added to Supported Groups, QSH (deprecated and removed), Dual Algorithm Certificate, and TLS 1.3 Dual Algorithm Authentication Support
• Hybrid TLS Key Establishment Schemes:
  • ECDHE P-256 with Kyber Level 1
  • ECDHE P-384 with Kyber Level 3
  • ECDHE P-521 with Kyber Level 5
• Public Key Cryptography Standards:
  • PKCS #1 - RSA Cryptography
  • PKCS #3 - Diffie-Hellman Key Agreement
  • PKCS #5 - Password-Based Encryption
  • PKCS #7 - Cryptographic Message Syntax (CMS)
  • PKCS #8 - Private-Key Information Syntax
  • PKCS #9 - Selected Attribute Types
  • PKCS #10 - Certificate signing request (CSR)
  • PKCS #11 - Cryptographic Token Interface
  • PKCS #12 - Certificate/Personal Information Exchange Syntax Standard
• QUIC support
• OCSP, OCSP Stapling, CRL
• HPKE (Hybrid Public Key Encryption)
• ECH (Encryption Client Hello)
• x.509v3 Certificates
• Mutual authentication

Protocol Notes:

• SSL 2.0 – SSL 2.0 was deprecated (prohibited) in 2011 by RFC 6176. wolfSSL does not support it.
• SSL 3.0 – SSL 3.0 was deprecated (prohibited) in 2015 by RFC 7568. In response to the POODLE attack, SSL 3.0 has been disabled by default since wolfSSL 3.6.6, but can be enabled with a compile-time option.^[12]

wolfSSL uses the following cryptography libraries:

wolfSSL provides support for a range of post-quantum cryptographic algorithms, including the Kyber Key Encapsulation Mechanism (KEM), hybridized with NIST-recommended ECC curves to maintain FIPS compliance. Supported ML-KEM levels include Level 1 (ML-KEM-512), Level 3 (ML-KEM-768), and Level 5 (ML-KEM-1024). For digital signatures, wolfSSL implements ML-DSA at Levels 2, 3, and 5; FALCON at Levels 1 and 5; and SLH-DSA, LMS/HSS, and XMSS/XMSS^MT. The library also supports hybrid TLS key exchange schemes, combining ECDHE with ML-KEM at corresponding security levels as well as dual-algorithm certificates and TLS 1.3 dual-algorithm authentication.

wolfSSL is dual licensed: under both the GPL-3.0-or-later license and commercial licensing.

• Transport Layer Security
• Comparison of TLS implementations
• Comparison of cryptography libraries
• GnuTLS
• Network Security Services
• OpenSSL

• wolfSSL/CyaSSL Homepage
• wolfSSL Now With ChaCha20 and Poly1305