The OpenSSL team publishes source code only, and expects that operating system maintainers (mainly Linux but also the communities for Apple and Windows) to compile it themselves into executable code and redistribute those compiled copies in the usual fashion.
While there's a guy in Minnesota and some random person on the Internet who do the compilation work and provide executables as a service for the Windows community, the rule with security-sensitive software like this is that it's only trustworthy if you compile it yourself from source code that you've confirmed matches the official release's source code, using a compiler that you know to be good and trustworthy. David's tried to do that a few times, and I appreciate him putting in the effort to make sure we're safe, but the last we heard he couldn't get the resulting executable to say it was compiled correctly.
On a side note, I don't recommend using the binaries I've linked above with the current versions of Pegasus and Mercury. The 1.1.1 releases refuse to work at all. The 1.0.2 releases do work, to a point. And then someone using Outlook Mail for iPhone tries to connect over IMAPS and pull a few thousand messages and a mismatch in memory allocation causes Mercury to crash. But using 1.0.2 and dealing with the constant crashes is better, for me in my situation, than using the copy that came with Mercury that doesn't support TLS 1.2. That said, I eagerly await an official Mercury update with up-to-date OpenSSL.
<p>The OpenSSL team publishes source code only, and expects that operating system maintainers (mainly Linux but also the communities for Apple and Windows) to compile it themselves into executable code and redistribute those compiled copies in the usual fashion.</p><p>&nbsp;While there's <a mce_href="https://slproweb.com/products/Win32OpenSSL.html" title="Shining Light Productions OpenSSL for Windows" href="https://slproweb.com/products/Win32OpenSSL.html">a guy in Minnesota</a> and <a mce_href="https://bintray.com/vszakats/generic/openssl" title="Victor Szakats' OpenSSL Builds for Mac Homebrew and Windows" href="https://bintray.com/vszakats/generic/openssl">some random person on the Internet</a> who do the compilation work and provide executables as a service for the Windows community, the rule with security-sensitive software like this is that it's only trustworthy if you compile it yourself from source code that you've confirmed matches the official release's source code, using a compiler that you know to be good and trustworthy. David's tried to do that a few times, and I appreciate him putting in the effort to make sure we're safe, but <a mce_href="http://www.pmail.com/devnews.htm" title="Pegasus Mail Developer News (Dec 2019)" href="http://www.pmail.com/devnews.htm">the last we heard</a> he couldn't get the resulting executable to say it was compiled correctly.</p><p>&nbsp;On a side note, I don't recommend using the binaries I've linked above with the current versions of Pegasus and Mercury. The 1.1.1 releases refuse to work at all. The 1.0.2 releases <i>do work, to a point</i>. And then someone using Outlook Mail for iPhone tries to connect over IMAPS and pull a few thousand messages and a mismatch in memory allocation causes Mercury to crash. But using 1.0.2 and dealing with the constant crashes is better, for me in my situation, than using the copy that came with Mercury that doesn't support TLS 1.2. That said, I <u>eagerly</u> await an official Mercury update with up-to-date OpenSSL.
</p>
