Lets say again:
- Alma 8 has same packages as RHEL 8
- RHEL 8 has some version of openssl. The openssl is a core package that several services depend on. They are built to use the openssl that RHEL 8 has
- Red Hat does support the version of openssl that is in RHEL 8. They do backport fixes and features. See What is backporting and how does it affect Red Hat Enterprise Linux (RHEL)? - Red Hat Customer Portal
- RHEL 8 (and hence Alma 8) will have supported version of openssl its entire life-cycle
- EPEL is extra packages – volunteer additions; no SLA like RHEL content
The “server” will not automatically use openssl3; you would have to replace all applications/services with versions that do. It would be easier to switch to distro that does have openssl3 natively. For example, AlmaLinux 9.
That said, run:
rpm -q --changelog openssl3 | less
That is where CVEs are usually mentioned.