OpenSSL 4.1.0: What’s new, what’s removed, and what’s still broken

OpenSSL 4.1.0 introduces DTLS 1.3 but ships with four DTLS bugs that may make applications misinterpret connection state (e.g., permanent receive failures appearing as SSL_ERROR_WANT_READ, retryable write failures surfaced as SSL_ERROR_SYSCALL), abort handshakes after packet loss, and drop retransmission of NewSessionTicket following a KeyUpdate; one fix is in progress while others have no listed fix. The release also removes ineffective build flags (no-ecdsa/no-ecdh), drops some Windows build targets, requires a new Perl module for the tsget utility, and includes various performance and post-quantum math optimizations.