Licensing issue with openssl <3.0 #1832

New Issue

MrUnknownDE · 2026-04-06T02:27:16+02:00

MrUnknownDE commented

2026-04-06 02:27:16 +02:00

Originally created by @dionysius on 12/29/2022

While building my debian packaging I got informed by the tooling that vaultwarden, licensed as GPL-3, links to openssl, licensed as either Apache 2.0 (v3.0+) or the dual OpenSSL and SSLeay license (<v3.0), which can be incompatible. Apache 2.0 seems fine from my mind, but I'm not fit in that licensing jungle. The OpenSSL license for <3.0 seem to be the issue.

Linking a stackoverflow question which summerizes the situation and solution pretty well.

Current Ubuntu LTS jammy uses openssl 3.0.0, but current Debian stable bullseye uses openssl 1.1.1. It's good that we soon don't have to worry anymore once openssl 3.0.0 is rolled out everywhere (implicates that my above assumption is correct regarding Apache 2.0).

Is it possible to include an exception for openssl as they've discussed in the above stackoverflow question? So far I couldn't find such an exception in the current license text yet.

*Originally created by @dionysius on 12/29/2022* While building my debian packaging I got informed by the tooling that vaultwarden, [licensed as GPL-3](https://github.com/dani-garcia/vaultwarden/blob/main/LICENSE.txt), links to openssl, [licensed as either Apache 2.0 (v3.0+) or the dual OpenSSL and SSLeay license (<v3.0)](https://www.openssl.org/source/license.html), which can be incompatible. _Apache 2.0 seems fine from my mind, **but I'm not fit in that licensing jungle**_. The OpenSSL license for <3.0 seem to be the issue. [Linking a stackoverflow question which summerizes the situation and solution pretty well.](https://opensource.stackexchange.com/questions/2233/gpl-v3-with-openssl-exception) Current Ubuntu LTS jammy uses openssl 3.0.0, but current Debian stable bullseye uses openssl 1.1.1. It's good that we soon don't have to worry anymore once openssl 3.0.0 is rolled out everywhere (implicates that my above assumption is correct regarding Apache 2.0). Is it possible to include an exception for openssl as they've discussed in the above stackoverflow question? So far I couldn't find such an exception in the current license text yet.

MrUnknownDE closed this issue

2026-04-06 02:27:16 +02:00

Sign in to join this conversation.

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/vaultwarden#1832