CentOS 10 Stream and RHEL 10 provides openssl version 3.5.1 at their BaseOS repository. But, why we are sticking on OpenSSL v3.2.2 on AlmaLinux 10?
Even I see Oracle Linux and RockyLinux 10 also sticking on 3.2.2. Shouldn’t we upgrade when it is available on the main derivates?
Hi @skrlance!
AlmaLinux follows RHEL 1:1, not CentOS. RHEL 10 GA pins OpenSSL to 3.2.x and backports all security fixes, so 3.2.2 in BaseOS already has the patches while keeping stability.
All the best! 
Hello
AlmaLinux GA releases follow RHEL GA 1:1, not CentOS Stream.
RHEL 10 GA is pinned to OpenSSL 3.2.x for ABI/API stability, and all security fixes from newer versions are backported to that branch.
This means you get the same security level as 3.5.x without breaking compatibility for software built against 3.2.x — a common practice in enterprise distributions.
CentOS Stream (and other development tracks) may move to newer feature versions like 3.5.x earlier.
AlmaLinux has its own development track called AlmaLinux OS Kitten, which also contains OpenSSL 3.5.x packages.
If you want to test with the newer version on AlmaLinux, you can enable the Kitten repos:
https://kitten.repo.almalinux.org/10-kitten/BaseOS/x86_64/os/Packages/
(For example: openssl-3.5.0-2.el10.alma.x86_64.rpm is available there.)
So in short: GA stays on 3.2.x for stability, Kitten/Stream-type builds can use 3.5.x for testing and development.
thanks