YuOpenSSL

YuOpenSSL is the only OpenSSL implementation for Delphi which does not require OpenSSL DLLs. YuOpenSSL enables Delphi applications to compile encryption and Internet security into a single executable with no dependencies. This ensures complete control over the OpenSSL version and ends all worries about DLL deployment and locations.

OpenSSL is one of the most feature-rich cryptographc Internet security libraries. It includes message digests, ciphers, synchronous and asynchronous encryption, QUIC, TLS, and SSL protocols, and much more. YuOpenSSL provides more than 3000 functions & procedures, 3700 constants, and 700 types.

YuOpenSSL provides all OpenSSL functionaliy in a single Delphi units, YuOpenSSL.pas, which replaces the following DLLs:

There are currently three versions of YuOpenSSL, available as separate packages. The YuOpenSSL license covers all versions:

YuOpenSSL-3.3

YuOpenSSL-3.3 is based on the OpenSSL 3.3 series. It superseeds YuOpenSSL-3.0 (see below) and is compatible with it just as OpenSSL 3.3 is compatible with OpenSSL 3.0.

YuOpenSSL-3.3 will follow updates to OpenSSL 3.3, which will be supported until 2026-04-09.

YuOpenSSL-3.0

YuOpenSSL-3.0 is based on the OpenSSL 3.0 series. It superseeds YuOpenSSL-1.1.1 (see below) and is compatible with it just as OpenSSL 3.0 is compatible with OpenSSL 1.1.1.

YuOpenSSL-3.0 will follow updates to OpenSSL 3.0, which will be supported until 2026-09-07 (LTS).

YuOpenSSL-1.1.1

YuOpenSSL-1.1.1 is based on OpenSSL 1.1.1w.

OpenSSL 1.1.1 has reached its end of life on 2023-09-11 and YuOpenSSL-1.1.1 will not see further development either. Upgrading to YuOpenSSL-3.0 or YuOpenSSL-3.3 is recommended and should as easy as re-building applications with the new version.

YuOpenSSL currently supports the following 3rd party Internet components and libraries. With YuOpenSSL, they no longer require external OpenSSL DLLs for secure TLS / SSL Internet connections. All work with both YuOpenSSL versions.

ICS – Internet Component Suite

ICS can be compiled against YuOpenSSL. Starting with ICS 8.66, YuOpenSSL support is readily built in. For the older versions 8.65 and 8.64, minimally modified ICS sources are bundled with YuOpenSSL.

YuOpenSSL is enabled by $defining the YuOpenSSL compiler directive. This makes it easy to switch between ICS with OpenSSL DLLs and ICS with YuOpenSSL (and without DLLs).

Indy – Internet Direct

Indy can be compiled against YuOpenSSL. YuOpenSSL includes modified sources of the new Indy OpenSSL 1.1.1 IOHander. It adds TLS 1.3 as a new feature. YuOpenSSL is enabled by $defining the YuOpenSSL compiler directive. This makes it easy to switch between Indy with OpenSSL DLLs and Indy with YuOpenSSL (and without DLLs).

The new Indy OpenSSL 1.1.1 IOHandler is still in development. Testing is recommended.

Synapse TCP/IP and serial library

Synapse can be compiled against YuOpenSSL. YuOpenSSL includes modified sources of the Synapse OpenSSL bindings. YuOpenSSL is enabled by $defining the YuOpenSSL compiler directive. This makes it easy to switch between Synapse with OpenSSL DLLs and Synapse with YuOpenSSL (and without DLLs).

YuOpenSSL development uncovered problems in Delphi 3rd party Internet components. They have been reported to their developers and are fixed in the latest version. Here is the list:

ICS – Internet Component Suite

• Fixed in ICS 8.66:
  1. 2 wrong function parameter types in OverbyteIcsLIBEAY.pas, possible memory overwrite
• Fixed in ICS 8.65:
  1. 7 memory leaks in OverbyteIcsWSocket.pas - with fixes
  2. OverbyteIcsLIBEAY.pas: EVP_PKEY_paramgen() pkey parameter should be double pointer
  3. OverbyteIcsLIBEAY.pas: f_CRYPTO_get_ex_data should return Pointer, not Integer
  4. OverbyteIcsLIBEAY.pas: TCryptoExNewFunc should be procedure, not function
• Fixed in ICS 8.64:
  1. Memory leak in OverbyteIcsWSocket.pas
  2. OverbyteIcsWSocket.SslWSocketCopyRight does not exist
  3. f_SSL_bytes_to_cipher_list should use var or ptr_ptr
  4. TProto_msg_cb is a function but must be a procedure, at least for SSL_set_msg_callback().
  5. f_SSL_clear : SSL_clear is a function and returns an integer
  6. f_X509_check_ip_asc has extra namelen parameter
  7. OverbyteIcsLIBEAY.pas f_EVP_DigestSignInit() declaration mismatch
  8. OverbyteIcsWSocket.pas bug: PunyServerName filled with 8-bit data, even if it is a 16-bit UnicodeString

Indy – Internet Direct

• Fixed in the Indy OpenSSL 1.1.1 IOHandler GIT repository:
  1. TIdOpenSSLX509.SaveToFile() uses BIO type instead of PBIO
  2. Leak of memory allocaated to thread-local storage (TLS) due to inappropriate initialization of SSL/TLS handshake
  3. Memory leak in TIdOpenSSLContextClient class
  4. Free before use access violation

Synapse TCP/IP and serial library

• Fixed in Synapse SVN r266:
  1. function d2iX509bio(): Wrong order of arguments in implementation