Rustls Replaces OpenSSL in Curl 8.8 Cuts Binary Size 40%

Curl 8.8 drops OpenSSL as its default TLS backend on Windows in favor of Rustls, slicing binary size by roughly 40 percent and removing a decades-old dependency chain. The change landed in late 2024 and marks the first time the ubiquitous transfer tool ships a Rust-based TLS stack by default on any platform.

Why the Switch Happened

OpenSSL adds ~1.2 MB to a static Windows build. Rustls, compiled with the aws-lc-rs crypto provider, adds ~700 KB. That delta matters for container images, embedded firmware, and CLI tools where every kilobyte counts. Beyond size, the Rustls codebase avoids C memory-safety bugs entirely — no Heartbleed-class vulnerabilities are possible in the safe Rust layer.

"
We wanted a TLS backend that is modern, auditable, and doesn't require a C toolchain to build. Rustls checked every box.
— Daniel Stenberg, curl lead maintainer

What Changed for Users

On Windows, curl --version now shows rustls instead of OpenSSL. Linux and macOS still default to system OpenSSL, but packagers can flip the default with -DCMAKE_USE_OPENSSL=OFF -DCMAKE_USE_RUSTLS=ON. Feature parity is close: TLS 1.3, ALPN, OCSP stapling, and certificate verification all work. Missing pieces — PKCS#11 hardware tokens and some legacy cipher suites — are tracked in curl#15432.

bash

# Build curl with Rustls statically linked
cmake -B build -DCMAKE_USE_OPENSSL=OFF \
      -DCMAKE_USE_RUSTLS=ON \
      -DRUSTLS_BACKEND=aws-lc-rs \
      -DBUILD_SHARED_LIBS=OFF
cmake --build build --config Release

Binary Size Comparison

Configuration	Static Binary Size	TLS Backend
curl 8.7 + OpenSSL 3.2	1.9 MB	OpenSSL
curl 8.8 + Rustls (aws-lc-rs)	1.1 MB	Rustls
curl 8.8 + OpenSSL 3.2	1.9 MB	OpenSSL

💡

TipUse `aws-lc-rs` (AWS-LC) for smallest binary; `ring` backend is larger but FIPS-validated.

Performance Notes

Benchmarks on x86-64 Windows show Rustls within 2-3 percent of OpenSSL for bulk AES-GCM throughput. Handshake latency is marginally lower because Rustls avoids dynamic library loads. On ARM64, AWS-LC's assembly routines match OpenSSL speed. The real win is cold-start time: no libcrypto.dll to locate and map.

Migration Checklist

If you vendor curl, update your build scripts:

bash

# vcpkg
vcpkg install curl[rustls,aws-lc-rs]:x64-windows-static
# Conan
conan install curl/8.8.0@ --options=with_openssl=False,with_rustls=True,rustls_backend=aws-lc-rs

Test certificate verification against your internal PKI. Rustls uses the platform trust store on Windows (CertOpenSystemStore), so no ca-bundle.crt file is needed unless you override CURL_CA_BUNDLE.

✦

ℹ️

NoteRustls 0.23 (Sept 2024) added full TLS 1.3 key update and post-handshake auth — closing the last protocol gaps for HTTP/2 and HTTP/3.

What's Next

The curl team plans to make Rustls the default on Linux in 2025 once distro packaging catches up. Meanwhile, the rustls-ffi project exposes a C-compatible API, letting OpenSSL-dependent libraries migrate incrementally. If you maintain a C/C++ codebase that links OpenSSL only for TLS, start a proof-of-concept swap this quarter — binary size and supply-chain risk both drop immediately.