0.8.0 (2026-10-06)

• Fix naked pointer in cipher function (#144)
• Copy OCaml strings before releasing the runtime lock: another thread could move them, making OpenSSL read a stale path, e.g. Ssl.use_certificate failing with No such file or directory on an existing key file.
• Ssl.set_ip, Ssl.set_host and Ssl.set_client_SNI_hostname raise Invalid_argument instead of silently ignoring a value OpenSSL rejects. An unparsable IP address used to disable the check, accepting any certificate.
• ALPN: an exception raised by the selection callback, or a protocol the client did not offer, fails the handshake instead of unwinding through OpenSSL. The selected protocol no longer points into the OCaml heap after the runtime lock is released. Protocol names must be 1 to 255 bytes long.
• Ssl.set_password_callback: an exception from the callback, or a password longer than OpenSSL's buffer, makes loading the key fail with Private_key_error instead of unwinding through OpenSSL or aborting.
• Fix memory leaks in add_extra_chain_cert, add_cert_to_store, use_certificate_from_string, get_issuer, get_subject, and in read and write when given invalid arguments.
• Ssl.use_certificate_from_string decrypts the key with the context's password callback, like Ssl.use_certificate, instead of prompting on the terminal.
• Password and ALPN selection callbacks are released with their context, and setting one again replaces it, instead of leaking a GC root on every call.
• Ssl.input_string returns what it read once the peer closes the connection, instead of always raising Read_error (#152).
• When pkg-config cannot find OpenSSL, the build warns and the fallback flags always link -lssl -lcrypto; on macOS they used to only add a search path, failing at link time (#55).
• Read and write functions check their offset and length in one place, without overflowing. A huge offset used to be truncated to 32 bits, silently reading at another position, and on Runtime_lock functions raised an exception that could not be caught.
• Functions taking a file name, host name, cipher list or curve name raise Invalid_argument on a string containing a NUL byte, instead of silently using the part before it.

0.7.0 (2023-07-12)

• Bump OpenSSL minimum requirement to 1.1.0 and stop using deprecated functions (#121).
• Make the functions in Ssl.Runtime_lock call non-allocating function on the C stubs and mark them with [@@noalloc] (#117).
• Add Ssl.{get,set}_{min,max}_protocol_version to specify the desired TLS version ranges for a Ssl.context (#132)
• Add Ssl.native_library_version to query the underlying SSL library verion (#140)
• Ssl.Error: separate library number from reason code (#139, #142)

0.6.0 (2023-06-01)

• Raise an error when Ssl.flush isn't successful (#104, #120)
• Add an API-compatible Ssl.Runtime_lock module. The functions in this module don't release the OCaml runtime lock. While they don't allow other OCaml threads to run concurrently, they don't perform any copying in the underlying data, leading certain workloads to be faster than their counterparts that release the lock. (#106)
• Guarantee Ssl.output_string writes the whole string by retrying the operation with unwritten bytes (#103, #116)
• Fix calls in C stubs that need to call ERR_clear_error before the underlying OpenSSL call (#118)
• Add a module Ssl.Error to retrieve OpenSSL errors in a structured way (#119)
• Deprecate Ssl.{SSLv23,SSLv3,TLSv1,TLSv1_1}, which were were formally deprecated in March 2021 and earlier (#115).

0.5.13 (2022-10-20)

• Add Ssl.close_notify to perform a one-way shutdown (#63, #96).

0.5.12 (2022-08-12)

• Add a few verification functions (#71):

  • add_extra_chain_cert to send additional chain certificates to the peer.
  • add_cert_to_store: to allow verification of the peer certificate CA.
  • set_ip: sets the expected IP address to be verified on an SSL socket.
• Improve use_certificate_from_string (#71) to read any type of key (rather than just RSA).
• Fix a segmentation fault in the ALPN selection callback under OCaml 5 (#89).
• Audit the C FFI and add CAMLparamX and CAMLreturn calls (#90).

0.5.11 (2022-07-24)

• Add digest function (#65, #66).
• Restore compatibility with openssl < 1.1.0 (#73).
• Improved compatibility with OCaml 5 (#79).
• Fix client_verify_callback for NO_NAKED_POINTERS mode. A user-provided verification function in C remains an out-of-heap pointer for 4.x for compatibility, but is boxed for OCaml 5.x or 4.x when configured with --disable-naked-pointers. (#83)

0.5.10 (2021-02-01)

• Add use_certificate_from_string (#54).
• Add get_verify_error_string, get_start_date, get_expiration_date (#57).
• Release master lock on ALPN failure (#58).
• Add version (#60).
• Switch to dune 2 (#61).

0.5.9 (2019-07-15)

• Backward compatibility with OpenSSL 1.0.2 (#53).

0.5.8 (2019-07-03)

• Better error reporting.
• Add support for hostname validation (#49).
• Add ALPN support (#37, #38, #48).

0.5.7 (2018-10-25)

• Correctly set #defines (#40).
• Correctly deal with non-existent directories for Homebrew (#42).

0.5.6 (2018-09-12)

• Switch to the dune build system.

0.5.5 (2017-10-13)

• Make sure that LDFLAGS is honored during build.

0.5.4 (2017-10-02)

• Enable safe-string compatibility (#32).
• Add -std=c99 to CFLAGS (#29).

0.5.3 (2016-11-08)

• Remove -ansi flag to be compatible with OCaml 4.04 (thanks Mark Shinwell).
• Use accessor functions for X509_STORE_CTX.
• Change CLIBS order to allow static linking.

0.5.2 (2015-11-23)

• Add OPENSSL_NO_SSL3 preprocessor flag to disable SSLv3 (thanks Jérémie Courrèges-Anglas).

0.5.1 (2015-05-27)

• Fix META file for versions of OCaml older than 4.02.0 (thanks Anil Madhavapeddy, closes #20).

0.5.0 (2015-05-18)

• Allow to honor server cipher preferences (thanks mfp, closes #18).
• Add functions for reading into/writing from bigarrays, avoiding copy (thanks mfp, closes #15).
• Support disabling SSL protocol versions (thanks Edwin Török, closes #13).
• Use Bytes instead of String for read and write, changes the ABI thus the version bump (thanks Vincent Bernardoff, closes #16, and mfp, closes #19).
• Make verbosity of client_verify_callback configurable (thanks Nicolas Trangez, closes #12).
• Fix build with old versions of SSL (thanks Edwin Török, closes #10).

0.4.7 (2014-04-21)

• Add support for TLS1.1 and TLS1.2 (thanks Thomas Calderon).
• Add function to initialize Diffie-Hellman and elliptic curve parameters (thanks Thomas Calderon and Edwin Török).
• Add set_client_SNI_hostname to specify client-side SNI hostname (thanks Mauricio Fernandez).
• Fix double leave of blocking section in ocaml_ssl_accept (thanks Edwin Török).
• Check for errors in SSL_connect/SSL_accept (thanks Jérôme Vouillon).
• Clear the error queue before calling SSL_read and similar functions; SSL_get_error does not work reliably otherwise (thanks Jérôme Vouillon).
• Allow static linking on Mingw64 (thanks schadinger).

0.4.6 (2011-10-16)

• Added write_certificate function.
• Remove support for SSLv2, which was dropped upstream (thanks Dario Teixeira).
• Added support for compiling under Win32 (thanks David Allsopp), see README.win32.
• Check for pthreads in configure.

0.4.5 (2011-03-01)

• Use pthread mutexes for locking thread-safe version of ssl.

0.4.4 (2010-01-06)

• Use SSL_CTX_use_certificate_chain_file instead of SSL_CTX_use_certificate_file.
• Added support for --enable-debugging configure option.
• Don't link with unix library and don't build in custom mode.

0.4.3 (2008-12-18)

• Don't use blocking sections in finalizers since it causes segfaults (thanks Grégoire Henry and Stéphane Glondu).

0.4.2 (2007-03-29)

• Added some missing blocking sections (reported by Oscar Hellström).

0.4.1 (2007-02-21)

• file_descr_of_socket is not marked as deprecated anymore.
• Patched the Makefile to be compatible with FreeBSD (thanks Jaap Boender).
• Explicitly link with libcrypto since we use it. Compilation should now work on Mac OS X too (thanks Janne Hellsten).

0.4.0 (2006-09-09)

• Using caml_alloc_custom and Data_custom_val to access custom blocks.
• Added set_password_callback function.
• Integrated a big patch from Chris Waterson:
• Added get_error_string function.
• Read and write are not blocking anymore, use Unix.select and file_descr_of_socket if you want blocking functions.
• Fix SSL_CTX initialization to call SSL_CTX_set_mode(3) with SSL_MODE_AUTO_RETRY flag. This causes SSL_read and SSL_write to "hide" the SSL_ERROR_WANT_(READ|WRITE) errors that may occur during renegotiation on a blocking socket.
• Fix SSL_CTX initialization to call SSL_CTX_set_mode(3) with SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER flag. This allows for a different buffer address to be passed to a restarted non-blocking write operation, which is useful since the OCaml garbage collector may move buffers around between calls.
• We do not need to store explicitly the file descriptor for SSL sockets.
• Corrected checking of errors in ocaml_ssl_read (thanks Vincent Balat and Nataliya Guts).
• input_char now raises End_of_file when no byte could be read (thanks Nataliya Guts).

0.3.1 (2005-07-21)

• The library is now under the LGPL licence + linking exception + linking with openssl exception (see COPYING for more details).

0.3.0 (2005-06-01)

• Added Ssl_threads.init function to make the library thread-safe.
• Put connect, accept and flush (and all other functions) in blocking_section to allow other threads to run in the meantime.
• Unified the three context creation functions in create_context, the certificate to use should now be specified with use_certificate (sorry for the API-breakage).
• Added the get_verify_result function.
• Using Store_field instead of Field(...) = ...
• Using caml namespace functions.

0.2.0 (2004-12-18)

• Many thanks to Thomas Fischbacher for his patches:
• Corrected int / val bugs when raising exceptions from C (those where found by Mike Furr too, thanks).
• Added many functions (but in Caml instead of C).
• Context creation functions now take the protocol as argument.
• Added the create_context function (for client and server connections).
• Added functions for verifying certificates: client_verify_callback, set_verify, set_verify_depth, verify.
• The cipher now has its own type.
• Added functions to handle ciphers: get_current_cipher, get_cipher_description, get_cipher_name, get_cipher_version, set_cipher_list.
• Added the read_certificate and load_verify_locations functions.
• Added the open_connection_with_context and flush functions.
• read and write functions are now thread-safe.
• Cleaned the stubs (function prototypes, comments, etc.).
• Updated OCamlMakefile and improved build system.

0.1.0 (2004-02-05)

• Initial release.