Add support for OpenSSL 3.0

[pshipton]

Now that OpenSSL 3.0 is released, there should be support for it. OpenSSL 1.1.1 goes out of support 2023-09-11.

Note the license for v3 is different.
https://www.openssl.org/source/license.html

@ashbm5

[pshipton]

Ubuntu 22_04 and RHEL 9 don't come with openssl 1.1 installed but openssl 3 instead. OpenJ9 crypto performance will not be good out of the box unless openssl 3 support is working.

[doveye]

This will require doc updates too, to say we're supporting OpenSSL 3.0 but also some topics mention OpenSSL versions, eg:

• https://www.eclipse.org/openj9/docs/builds/
• https://www.eclipse.org/openj9/docs/introduction/
• https://www.eclipse.org/openj9/docs/jitserver/

[doveye]

I've opened a doc issue at eclipse-openj9/openj9-docs#924. I've said this change applies to all JDK versions and all platforms - please add a comment to the doc issue if that assumption is incorrect.

[pshipton]

OpenSSL v3 runtime support is added for Linux only in 0.32. Build support is in progress for a future release.

[DanHeidinga]

Sounds like we need an option like -XX:[+-]AllowOutOfSupportOpenSSL so the VM will default to only use the supported openssl versions but users can still opt into the old versions

[jasonkatonica]

Hi Peter,
The openssl Semeru crypto code, which makes use of the openssl library, is currently able to tolerate openssl version 3.x APIs. We do have additional future work to migrate openssl 1.x deprecated APIs to openssl 3.x APIs. We do not believe this should prevent us from attempting to moving forward in next release with bundling / supporting openssl 3.x given that 1.x goes out of service this fall.

Since we are planning on shipping the 1.x bundled version of openssl with mac and windows in this next release, Id suggest that we shift to 3.x in the release following ( .40 ).

I do think that some packaging and build work will need to be done in order to build openssl 3.x on various platforms from source. I am unsure who will be working on this aspect of the issue.

[pshipton]

We can move this to the appropriate Milestone plan once it's created. I know there are still build problems and they haven't been getting much attention, there is some status here.

[pshipton]

v3 support is added.
ibmruntimes/openj9-openjdk-jdk#632
#14900
ibmruntimes/temurin-build#87

[doveye]

If OpenSSL 3 is now supported on operating systems other than Linux, please open another doc issue to make the necessary changes. For example, https://eclipse-openj9.github.io/openj9-docs/openssl/ still says it's Linux-only.

@Sreekala-Gopakumar FYI

[pshipton]

Thanks. Created eclipse-openj9/openj9-docs#1171