Key takeaways
- OpenSSL 3.0 reached end of life on September 7, 2026, and no longer receives public security fixes. OpenSSL 3.5 is a long-term support release with public support through April 8, 2030.
- On September 29, 2026, OpenSSL published fixes for 14 vulnerabilities, including one rated High. The OpenSSL 3.0 fixes went only to premium support customers.
- Cerberus FTP Server by Redwood 2026.3 and later run on OpenSSL 3.5.7, from the current OpenSSL long-term support branch. Earlier Cerberus versions 12.11.0 through 2026.2.x embed OpenSSL 3.0.
- Updating to the current Cerberus release moves your file transfer server to OpenSSL 3.5 without changing its FIPS 140-3 validated module.
OpenSSL 3.0 reached end of life on September 7, 2026. OpenSSL is the encryption library behind most secure file transfer servers. It protects FTPS and HTTPS connections and supplies cryptography for many SFTP implementations. After five years of long-term support, the 3.0 branch no longer receives publicly available security fixes.
If your file transfer server embeds OpenSSL, end of life is a timely reason to confirm which version you run and plan your move to a supported branch. This post shows you how to check which OpenSSL version your Cerberus server uses and how to update it.
What does OpenSSL 3.0 end of life mean?
OpenSSL 3.0 end of life means the OpenSSL project no longer publishes security fixes for the 3.0 branch. According to the OpenSSL announcement, 3.0 users should move to a supported branch: OpenSSL 3.5, a long-term support release supported through April 8, 2030, or OpenSSL 4.0, supported through May 14, 2027. Organizations that can’t upgrade right away can buy extended support from the OpenSSL project.
OpenSSL designates a long-term support release every two years and supports each one for five years, according to its release strategy. For a file transfer server that stays in production for years, an LTS branch gives you the longest runway between major upgrades.
What happened after OpenSSL 3.0 reached end of life?
Three weeks after OpenSSL 3.0 reached end of life, OpenSSL published its first major security advisory affecting the branch. On September 29, 2026, the advisory listed 14 vulnerabilities. One, CVE-2026-84782, is rated High. Several others affect OpenSSL 3.0.
The advisory lists OpenSSL 3.0.23 as the fix for the 3.0 branch, but marks it “Premium support customers only.” If you rely on public OpenSSL 3.0 releases, there is no public fix. Supported branches, including 3.5, received public fixes in 3.5.9. The Hacker News described this as the first 3.0 security release that OpenSSL didn’t make public.
Not every OpenSSL vulnerability affects every product. CVE-2026-84782, for example, involves DTLS, the version of TLS used over UDP. Whether a flaw affects your file transfer server depends on how the software uses OpenSSL. What changes at end of life is that you no longer get public fixes when a flaw does apply.
Which OpenSSL version does your Cerberus server use?
Your Cerberus FTP Server version tells you which OpenSSL version it embeds. The Cerberus release notes record each OpenSSL upgrade:
| Cerberus version | Embedded OpenSSL | Support status |
| Earlier than 12.11.0 | OpenSSL 1.0.2 | End of life |
| 12.11.0 through 2026.2.x | OpenSSL 3.0 (3.0.7 through 3.0.20) | End of life since September 7, 2026 |
| 2026.3 and later | OpenSSL 3.5.7 | Long-term support through April 8, 2030 |
Cerberus moved from OpenSSL 1.0.2 to OpenSSL 3 in version 12.11.0, released November 7, 2022. Our post on moving to OpenSSL 3 in Cerberus FTP Server 12.11 explains that change. Cerberus 2026.3, released August 26, 2026, upgraded OpenSSL to 3.5.7 LTS ahead of the 3.0 end-of-life date.
To check your server, find the Cerberus version in the Cerberus interface and match it to the table above. Record both version numbers in your software inventory.
How do you update Cerberus to OpenSSL 3.5?
You update Cerberus to OpenSSL 3.5 by downloading 2026.3.1. Cerberus doesn’t offer the OpenSSL library as a separate download. The current release is the only version available for download, and older builds are available through a support request.
- Back up your settings folder, C:\ProgramData\Cerberus LLC\Cerberus FTP Server, before you start.
- Test the new release in a staging environment with the clients and partners that connect to your server, especially any older SFTP or FTPS clients.
- Schedule a maintenance window. Cerberus estimates about five minutes of service interruption during your update..
- From version 13 or later, use Help > Check for Updates. From version 12 or earlier, download and run the latest installer manually and accept the new license agreement.
- Confirm that the Cerberus FTP Server Windows service is running and that partners can connect.
- Update your software inventory with the new Cerberus and OpenSSL versions.
The installer preserves your users and settings. If a version-based vulnerability scanner still flags a component after you update, check the release notes, which document known false positives.
Does the OpenSSL upgrade change FIPS validation?
No. The OpenSSL library and the FIPS-validated cryptographic module are separate pieces. Cerberus 2026.1 and later use the OpenSSL 3 FIPS Provider, certificate #4985, which is validated under FIPS 140-3. The OpenSSL project says that module works with OpenSSL 3.0 through 3.5, so moving to OpenSSL 3.5.7 keeps your FIPS 140-3 validation in place. Our guide to the FIPS 140-3 transition explains the details.
Your OpenSSL 3.0 end-of-life checklist
- List every Cerberus server and gateway and record its version.
- Match each version to its embedded OpenSSL version.
- Flag any server running OpenSSL 3.0 or 1.0.2.
- Test the current Cerberus release with your partners’ clients.
- Update in a maintenance window and confirm connections.
- Update your inventory with the new Cerberus and OpenSSL versions.
- Add the next OpenSSL support date to your review calendar.
Frequently asked questions
When did OpenSSL 3.0 reach end of life?
OpenSSL 3.0 reached end of life on September 7, 2026, after five years as a long-term support release. It no longer receives public security fixes. OpenSSL recommends moving to OpenSSL 3.5, supported through April 8, 2030, or OpenSSL 4.0.
Which Cerberus versions use OpenSSL 3.0?
Cerberus FTP Server versions 12.11.0 through 2026.2.x embed OpenSSL 3.0. Cerberus 2026.3 and later embed OpenSSL 3.5.7, a long-term support release.
Will upgrading OpenSSL break my FIPS 140-3 validation?
No. Cerberus 2026.1 and later use the OpenSSL 3 FIPS Provider, certificate #4985, which works with OpenSSL 3.0 through 3.5. Updating to Cerberus 2026.3 keeps the same validated module.
Quick facts about Cerberus FTP Server
- What it is: A secure file transfer server for Windows Server, made by Redwood Software.
- Protocols: SFTP, FTPS, HTTPS, SCP and FTP.
- Encryption: OpenSSL 3.5.7 LTS in version 2026.3, with FIPS 140-3 validated cryptography (certificate #4985).
- Security: Multi-factor authentication, IP allow and deny lists, geo-blocking and automatic account lockouts.
- Updates: Third-party component upgrades, such as OpenSSL, libssh2 and cURL, are documented in the release notes.
- Industries: Financial services, government and other regulated sectors. See secure file sharing for financial services.
Keep your file transfer server on supported encryption
OpenSSL 3.0 end of life is a reminder that your file transfer server is only as current as the components inside it. Cerberus FTP Server by Redwood tracks those components for you. Cerberus 2026.3 moved to OpenSSL 3.5 LTS before 3.0 reached end of life, and Redwood Software documents every component upgrade in the release notes, so you always know exactly what you run.
Start your free 25-day trial or explore Cerberus security features.
Sources and further reading
OpenSSL and NIST
- OpenSSL 3.0 end of life: OpenSSL announcement
- OpenSSL 3.5 will be the next long-term support release: OpenSSL announcement
- OpenSSL release strategy
- OpenSSL security advisory, September 29, 2026
- OpenSSL vulnerabilities list
- CVE-2026-84782 record
- NIST CMVP certificate #4985: OpenSSL FIPS Provider
Industry analysis
Cerberus resources