William Bellingrath

— On the schedule —

From 1.1.1 to 3.5: Modernizing OpenSSL for Enterprise Networking, FIPS 140-3, and Crypto Agility

This session presents a technical deep dive into upgrading the Junos operating system from OpenSSL 1.1.1 to 3.5 across an enterprise-grade networking portfolio spanning FreeBSD and Linux, and multiple architectures. In large-scale, compliance-driven environments, cryptographic upgrades are traditionally long-lived and high-risk, driven by platform diversity, FIPS 140-3 and Common Criteria requirements, and our modifications. This effort highlighted the cost of that model and became a catalyst for improvement. Rather than focusing solely on the changes brought by the upgrade, we examine how this transition exposed inefficiencies in our traditional upgrade approach and drove improvements toward crypto agility and faster upgrade cycles. We reworked our legacy based build and integration model to better support a modern OpenSSL cadence, reduced downstream divergence, and improved our ability to support multiple OpenSSL versions simultaneously where needed. This talk also explores the complexity of maintaining a single cryptographic library across diverse consumers with competing requirements, including significant libssl changes required for our SSL proxy and our chassis-based FIPS boundary. Finally, we look forward: how these changes position us to adopt newer OpenSSL releases more rapidly, including the potential for non-LTS releases.