The Transport Layer Security (TLS) protocol provides the ability to secure communications across or inside networks. This comparison of TLS implementations compares several of the most notable libraries. There are several TLS implementations which are free software and open source.
All comparison categories use the stable version of each implementation listed in the overview section. The comparison is limited to features that directly relate to the TLS protocol.
Overview
Implementation Developed by Open source Software license Copyright holder Written in Latest stable version, release date Origin Botan Jack Lloyd Jack Lloyd C++ US (Vermont) BoringSSL Google Eric Young, Tim Hudson, Sun, OpenSSL project, Google, and others C, C++, Go, assembly No stable releases Australia/EU Bouncy Castle The Legion of the Bouncy Castle Inc. Legion of the Bouncy Castle Inc. Java, C# Australia BSAFE Dell, formerly RSA Security Dell Java, C, assembly SSL-J Micro Edition Suite Australia cryptlib Peter Gutmann and commercial license Peter Gutmann C NZ GnuTLS GnuTLS project Free Software Foundation C EU (Greece and Sweden) Java Secure Socket Extension (JSSE) Oracle and commercial license Oracle Java US LibreSSL OpenBSD Project Eric Young, Tim Hudson, Sun, OpenSSL project, OpenBSD Project, and others C, assembly Canada MatrixSSLThe features listed are for the closed source version PeerSec Networks and commercial license PeerSec Networks C US Mbed TLS (previously PolarSSL) Arm and commercial license Arm Holdings C EU (Netherlands) Network Security Services (NSS) Mozilla, AOL, Red Hat, Sun, Oracle, Google and others NSS contributors C, assembly US OpenSSL OpenSSL project Eric Young, Tim Hudson, Sun, OpenSSL project, and others C, assembly Australia/EU Rustls Joe Birr-Pixton, Dirkjan Ochtman, Daniel McCarney, Josh Aas, and open source contributors Open source contributors Rust United Kingdom s2n Amazon and commercial license Amazon.com, Inc. C Continuous US Schannel Microsoft Microsoft Corporation Windows 11, 2021-10-05 USSecure Transport Apple Inc. Apple Inc. 57337.20.44 (OS X 10.11.2), 2015-12-08 US wolfSSL (previously CyaSSL) wolfSSL and commercial license wolfSSL Inc. C, assembly US Erlang/OTP SSL application Ericsson Ericsson ErlangOTP-29.0.4, 2026-07-27Sweden Implementation Developed by Open source Software license Copyright owner Written in Latest stable version, release date Origin
TLS/SSL protocol version support Several versions of the TLS protocol exist. SSL 2.0 is a deprecated protocol version with significant weaknesses. SSL 3.0 (1996) and TLS 1.0 (1999) are successors with two weaknesses in CBC-padding that were explained in 2001 by Serge Vaudenay. TLS 1.1 (2006) fixed only one of the problems, by switching to random initialization vectors (IV) for CBC block ciphers, whereas the more problematic use of mac-pad-encrypt instead of the secure pad-mac-encrypt was addressed with RFC 7366. A workaround for SSL 3.0 and TLS 1.0, roughly equivalent to random IVs from TLS 1.1, was widely adopted by many implementations in late 2011. In 2014, the POODLE vulnerability of SSL 3.0 was discovered, which takes advantage of the known vulnerabilities in CBC, and an insecure fallback negotiation used in browsers.
TLS 1.2 (2008) introduced a means to identify the hash used for digital signatures. While permitting the use of stronger hash functions for digital signatures in the future (rsa,sha256/sha384/sha512) over the SSL 3.0 conservative choice (rsa,sha1+md5), the TLS 1.2 protocol change inadvertently and substantially weakened the default digital signatures and provides (rsa,sha1) and even (rsa,md5).
Datagram Transport Layer Security (DTLS or Datagram TLS) 1.0 is a modification of TLS 1.1 for a packet-oriented transport layer, where packet loss and packet reordering have to be tolerated. The revision DTLS 1.2 based on TLS 1.2 was published in January 2012.
TLS 1.3 (2018) specified in RFC 8446 includes major optimizations and security improvements. QUIC (2021) specified in RFC 9000 and DTLS 1.3 (2022) specified in RFC 9147 builds on TLS 1.3. The publishing of TLS 1.3 and DTLS 1.3 obsoleted TLS 1.2 and DTLS 1.2.
Note that there are known vulnerabilities in SSL 2.0 and SSL 3.0. In 2021, IETF published RFC 8996 also forbidding negotiation of TLS 1.0, TLS 1.1, and DTLS 1.0 due to known vulnerabilities. NIST SP 800-52 requires support of TLS 1.3 by January 2024. Support of TLS 1.3 means that two compliant nodes will never negotiate TLS 1.2.
Implementation SSL 2.0 (insecure) SSL 3.0 (insecure) TLS 1.0 (deprecated) TLS 1.1 (deprecated) TLS 1.2 TLS 1.3 DTLS 1.0 (deprecated) DTLS 1.2 DTLS 1.3 Botan BoringSSL Bouncy Castle BSAFE SSL-J cryptlib GnuTLS JSSE LibreSSL MatrixSSL Mbed TLS (experimental) NSS OpenSSL Rustls s2n Schannel XP, 2003 Schannel Vista Schannel 2008 Schannel 7, 2008R2 Schannel 8, 2012 Schannel 8.1, 2012R2, 10 RTM & v1511 Schannel 10 v1607 / 2016 Schannel 11 / 2022 Secure Transport OS X 10.2–10.7, iOS 1–4 Secure Transport OS X 10.8–10.10, iOS 5–8 Secure Transport OS X 10.11, iOS 9 Secure Transport OS X 10.13, iOS 11 (draft version) wolfSSL Erlang/OTP SSL application Implementation SSL 2.0 (insecure) SSL 3.0 (insecure) TLS 1.0 (deprecated) TLS 1.1 (deprecated) TLS 1.2 TLS 1.3 DTLS 1.0 (deprecated) DTLS 1.2 DTLS 1.3
NSA Suite B Cryptography Required components for NSA Suite B Cryptography (RFC 6460) are: Advanced Encryption Standard (AES) with key sizes of 128 and 256 bits. For traffic flow, AES should be used with either the Counter Mode (CTR) for low bandwidth traffic or the Galois/Counter Mode (GCM) mode of operation for high bandwidth traffic (see Block cipher modes of operation) — symmetric encryption Elliptic Curve Digital Signature Algorithm (ECDSA) — digital signatures Elliptic Curve Diffie–Hellman (ECDH) — key agreement Secure Hash Algorithm 2 (SHA-256 and SHA-384) — message digest
Per CNSSP-15, the 256-bit elliptic curve (specified in FIPS 186-2), SHA-256, and AES with 128-bit keys are sufficient for protecting classified information up to the Secret level, while the 384-bit elliptic curve (specified in FIPS 186-2), SHA-384, and AES with 256-bit keys are necessary for the protection of Top Secret information.
Implementation TLS 1.2 Suite B Botan Bouncy Castle BSAFE cryptlib GnuTLS JSSE LibreSSL MatrixSSL Mbed TLS NSS OpenSSL Rustls S2n Schannel Secure Transport wolfSSL Implementation TLS 1.2 Suite B
Certifications Note that certain certifications have received serious negative criticism from people who are actually involved in them.
ImplementationFIPS 140-1, FIPS 140-2 FIPS 140-3 Level 1 Level 2 Level 1 BotanBouncy Castle BSAFE SSL-J cryptlib GnuTLS JSSE LibreSSL no support MatrixSSL Mbed TLS NSS OpenSSL Rustls Schannel Secure Transport wolfSSL Implementation Level 1 Level 2 Level 1FIPS 140-1, FIPS 140-2FIPS 140-3
Key exchange algorithms (certificate-only) This section lists the certificate verification functionality available in the various implementations. Implementation RSA RSA-EXPORT (insecure) DHE-RSA (forward secrecy) DHE-DSS (forward secrecy) ECDH-ECDSA ECDHE-ECDSA (forward secrecy) ECDH-RSA ECDHE-RSA (forward secrecy) GOST R 34.10-94, 34.10-2001 Botan BSAFE cryptlib GnuTLS JSSE LibreSSL MatrixSSL Mbed TLS NSS OpenSSL Rustls Schannel XP/2003 Extensions to support GOST in Schannel might be available. Schannel Vista/2008 Schannel 8/2012 Schannel 7/2008R2, 8.1/2012R2 Schannel 10 Secure Transport OS X 10.6 Secure Transport OS X 10.8-10.10 Secure Transport OS X 10.11 wolfSSL Erlang/OTP SSL application Implementation RSA RSA-EXPORT (insecure) DHE-RSA (forward secrecy) DHE-DSS (forward secrecy) ECDH-ECDSA ECDHE-ECDSA (forward secrecy) ECDH-RSA ECDHE-RSA (forward secrecy) GOST R 34.10-94, 34.10-2001
Key exchange algorithms (alternative key-exchanges) Implementation SRP SRP-DSS SRP-RSA PSK-RSA PSK DHE-PSK (forward secrecy) ECDHE-PSK (forward secrecy) KRB5 DH-ANON (insecure) ECDH-ANON (insecure) Botan BSAFE SSL-J cryptlib GnuTLS JSSE LibreSSL MatrixSSL Mbed TLS NSS OpenSSL Rustls Schannel Secure Transport wolfSSL Erlang/OTP SSL application Implementation SRP SRP-DSS SRP-RSA PSK-RSA PSK DHE-PSK (forward secrecy) ECDHE-PSK (forward secrecy) KRB5 DH-ANON (insecure) ECDH-ANON (insecure)
Certificate verification methods Implementation Application-defined PKIX path validation CRL OCSP DANE (DNSSEC) CT Botan Bouncy Castle BSAFE cryptlib GnuTLS JSSE LibreSSL MatrixSSL Mbed TLS NSS OpenSSL Rustls s2n Schannel Secure Transport wolfSSL Erlang/OTP SSL application Implementation Application-defined PKIX path validation CRL OCSP DANE (DNSSEC) CT
Encryption algorithms Implementation Block cipher with mode of operation Stream cipher None AES GCM AES CCMRFC 6655, RFC 7251 AES CBC Camellia GCM Camellia CBC ARIA GCM ARIA CBC SEED CBC CBC(insecure) CNT(proposed)This algorithm is not defined yet as TLS cipher suites in RFCs, is proposed in drafts. ChaCha20-Poly1305 Null(insecure)authentication only, no encryption Botan BoringSSL BSAFE SSL-J cryptlib GnuTLS JSSE LibreSSL MatrixSSL Mbed TLS NSS This algorithm is implemented in an NSS fork used by Pale Moon. OpenSSL Rustls Schannel XP/2003 Schannel Vista/2008, 2008R2, 2012 Schannel 7, 8, 8.1/2012R2 Schannel 10 Secure Transport OS X 10.6 - 10.10 Secure Transport OS X 10.11 wolfSSL Erlang/OTP SSL application Implementation Block cipher with mode of operation Stream cipher None AES GCM AES CCM AES CBC Camellia GCM Camellia CBC ARIA GCM ARIA CBC SEED CBC CBC(insecure) CNT(proposed) ChaCha20-Poly1305 Null(insecure) Notes
Obsolete algorithms Implementation Block cipher with mode of operation Stream cipher IDEA CBC(insecure) DES CBC(insecure) DES-40 CBC(EXPORT, insecure)40 bits strength of cipher suites were designed to operate at reduced key lengths in order to comply with US regulations about the export of cryptographic software containing certain strong encryption algorithms (see Export of cryptography from the United States). These weak suites are forbidden in TLS 1.1 and later. RC2-40 CBC(EXPORT, insecure) RC4-128(insecure)The RC4 attacks weaken or break RC4 used in SSL/TLS. Use of RC4 is prohibited by RFC 7465. RC4-40(EXPORT, insecure)The RC4 attacks weaken or break RC4 used in SSL/TLS. Botan BoringSSL BSAFE SSL-J cryptlib GnuTLS JSSE LibreSSL MatrixSSL Mbed TLS NSS OpenSSL Rustls Schannel XP/2003 Schannel Vista/2008 Schannel 7/2008R2 Schannel 8/2012 Schannel 8.1/2012R2 Schannel 10 Secure Transport OS X 10.6 Secure Transport OS X 10.7 Secure Transport OS X 10.8-10.9 Secure Transport OS X 10.10-10.11 Secure Transport macOS 10.12 wolfSSL Erlang/OTP SSL application Implementation Block cipher with mode of operation Stream cipher IDEA CBC(insecure) DES CBC(insecure) DES-40 CBC(EXPORT, insecure) RC2-40 CBC(EXPORT, insecure) RC4-128(insecure) RC4-40(EXPORT, insecure) Notes
Supported elliptic curves This section lists the supported elliptic curves by each implementation.
Defined curves in RFC 8446 (for TLS 1.3) and RFC 8422, 7027 (for TLS 1.2 and earlier)
applicable TLS versionTLS 1.3 and earlier TLS 1.2 and earlier Implementation secp256r1prime256v1(0x0017,RFC 8446 23RFC 8422) secp384r1(0x0018, 24) secp521r1(0x0019, 25) X25519(0x001D, 29) X448(0x001E, 30) brainpoolP256r1(26)RFC 7027 brainpoolP384r1(27) brainpoolP512r1(28) Botan BoringSSL (disabled by default) BSAFE GnuTLS JSSE x25519: JDK 13+Ed25519:JDK 15+ x448: JDK 13+Ed448: JDK 15+ LibreSSL MatrixSSL Mbed TLS NSS OpenSSL Rustls Not supported for ECDHE key exchange, as per rustls::crypto::aws_lc_rs::kx_group. Schannel Vista/2008, 7/2008R2, 8/2012, 8.1/2012R2, 10 Secure Transport wolfSSL Erlang/OTP SSL application Implementation secp256r1prime256v1(0x0017, 23) secp384r1(0x0018, 24) secp521r1(0x0019, 25) X25519(0x001D, 29) X448(0x001E, 30) brainpoolP256r1(26) brainpoolP384r1(27) brainpoolP512r1(28)
Deprecated curves in RFC 8422