The above statement holds for mod_ssl only, though. As I understand it, there are a lot of other work like: http://mail-archives.apache.org/mod_mbox/httpd-dev/201704.mbox/%3C946a1678-ea9a-31b0-d380-fa7faa412ff5%40gmail.com%3E If I get it correctly, they want to have 2.4.26 soon, but question is how much openssl 1.1.0 will be supported there.