Thanks for the consideration. There are a number of ways that I can deal with this
* Move SSL termination to Apache httpd to front end tomcat * Move SSL termination to a hardware load balancer product that we already deploy * Push up our timeline for move to RHEL9 I was just caught off guard a little bit, but I can deal with the move to OpenSSL 3.x requirements. Thanks again for all of the amazing work on providing great products with as much compatibility that you do -- Evan ________________________________ From: Mark Thomas <[email protected]> Sent: September 8, 2026 8:33 AM To: [email protected] <[email protected]> Subject: Re: [ANN] Apache Tomcat Native 1.3.9 released On 08/09/2026 15:43, Evan Rempel via users wrote: > Wow. The minimum version of OpenSSL was bumped to 3.0 making Apache Tomcat > Native 1.3.9 no longer compile on RHEL 8. > > This means that there is no latest Apache Tomcat Native that compiles under > RHEL8, which is not EOL until May 31, 2029. > > I was hoping that RHEL8 and Apache Tomcat Native 1.3 would continue to be a > supported combination until Apache Tomcat Native 1.3 went EOL in Mar 2027. We > were on track to move all of our Tomcat installations to RHEL9 by Mar 2027. > This drastically changes the time line. > > Any consideration to working around the requirement of OpenSSL 3.0? OpenSSL 1.1.1 was supported way beyond its end of life (Sept 2023) because of support in Debian 11 LTS (EOS August 2026). The Tomcat Native project generally tracks supported OpenSSL and APR versions in Debian and Ubuntu to determine the minimum versions for building Tomcat Native. As the changelog notes, 1.1.1 support was broken in 1.3.8 and no-one complained. The changes between 1.1.1 and current OpenSSL master are significant. If you want code the compiles cleaning you are (at the last count) effectively maintaining 3 implementations in one via directives). And that is before LibreSSL and BoringSSL support is taken into consideration. Taking all of that together, dropping 1.1.1 support was an attractive option compared to continuing to try and support 1.1.1 through to current OpenSSL master. It is also worth noting that OpenSSL 3.0.x (LTS) reached end of support yesterday. The latest releases of both 1.3.x and 2.0.x were built (for Windows) with 3.5.x (specifically, 3.5.8). It wouldn't be impossible to restore OpenSSL 1.1.1 support in the 1.3.x branch but that would require effort and given the tidal wave of AI generated security reports Tomcat is currently dealing restoring support for an OpenSSL version 3+ years beyond its end of support date is unlikely to be a priority for the current committers. A pull request that adds back 1.1.1 support (wrapped in appropriate directives so the 3.0.x build remains essentially as-is) would be considered. Even that would require work to restore OpenSSL 1.1.1 build and test environments (at least for me it would anyway). It might be worth a quick performance test to see if you still need Tomcat Native. Mark --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
