# Migrating Julia 1.10 from MbedTLS to OpenSSL in a 1.10 patch release

**URL:** <https://discourse.julialang.org/t/migrating-julia-1-10-from-mbedtls-to-openssl-in-a-1-10-patch-release/142799>\
**Category:** Internals & Design\
**Created:** [November 7, 2026, 3:01am UTC](https://discourse.julialang.org/t/migrating-julia-1-10-from-mbedtls-to-openssl-in-a-1-10-patch-release/142799 "2026-11-07T03:01:17Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dilumaluthge](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/dilumaluthge/32/29283_2.png) [@dilumaluthge](https://discourse.julialang.org/u/dilumaluthge)\
**Post date:** [November 7, 2026, 3:01am UTC](https://discourse.julialang.org/t/migrating-julia-1-10-from-mbedtls-to-openssl-in-a-1-10-patch-release/142799/1 "2026-11-07T03:01:17Z")

</div>

## Background

Julia 1.10 is currently the Julia LTS series. Julia 1.10 uses the MbedTLS 2.28 release series. MbedTLS 2.28 has accumulated multiple security problems. However, MbedTLS 2.28 is no longer supported by the upstream MbedTLS project and will not receive any further patch releases.

Therefore, we have made the difficult decision to migrate Julia 1.10 from OpenSSL to MbedTLS in a 1.10 patch release.

## Plan

There are two upcoming releases of Julia 1.10:

- Julia 1.10.14. This version will be the last Julia 1.10 release with MbedTLS in the standard library.
- Julia 1.10.15. This version will migrate the standard library from MbedTLS to OpenSSL.

From Julia 1.10.15 onward, Julia 1.10 will use OpenSSL and will no longer ship MbedTLS in the standard library. This will bring Julia 1.10 to parity with Julia 1.13+, which also uses OpenSSL.

We are aware that performing this migration in a 1.10 patch release may be disruptive to people’s existing manifests. We aren’t making this decision lightly. We’ve chosen this path because we are prioritizing security fixes over the disruption.

If you currently have a Julia 1.10 manifest, the upgrade from Julia 1.10.14 to Julia 1.10.15 may require you to re-resolve your manifest (e.g. `Pkg.resolve()`) in order to get things working.

The main reason that this may require re-resolving manifests is that we need to add two new stdlibs (OpenSSL\_jll and Zstd\_jll) and remove one stdlib (MbedTLS\_jll). We also need to modify the dependency graphs for stdlibs that currently depend on MbedTLS\_jll.

## Alternatives we considered

We considered multiple alternatives, including:

1. Keeping Julia 1.10 on MbedTLS 2.28.

2. Keep Julia 1.10 on MbedTLS, but upgrade from MbedTLS 2.28 to MbedTLS 4.1 (which, at time of writing, is the MbedTLS LTS release series).

3. Keeping the default Julia 1.10 on MbedTLS 2.28, but publish a new “variant” of Julia 1.10 that uses OpenSSL. Users would need to opt-in in order to use the OpenSSL variant of 1.10.

4. Choosing a new LTS version.

Ultimately, we believe that the pros/cons of our chosen plan outweight the pros/cons of the alternatives.

## Other Julia versions

- Julia 1.11 uses MbedTLS. Julia 1.11 is no longer officially supported. Users of Julia 1.11 should either upgrade to the latest stable release of Julia or downgrade to Julia LTS.
- Julia 1.12 uses OpenSSL. However, Julia 1.12 is no longer officially supported. Users of Julia 1.12 should either upgrade to the latest stable release of Julia or downgrade to Julia LTS.
- Julia versions \>= 1.13 use OpenSSL.

---

<div class="post-metadata">

**Author:** ![giordano](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/giordano/32/2166_2.png) [@giordano](https://discourse.julialang.org/u/giordano)\
**Post date:** [November 7, 2026, 11:48am UTC](https://discourse.julialang.org/t/migrating-julia-1-10-from-mbedtls-to-openssl-in-a-1-10-patch-release/142799/2 "2026-11-07T11:48:03Z")

</div>

> [@dilumaluthge](#):
>
> we have made the difficult decision to migrate Julia 1.10 from OpenSSL to MbedTLS in a 1.10 patch release.

Probably the other way around