From the article, it's using OpenSSL in EDK II In fact, a whole section of the article is dedicated to talking about how they got tripped up by OpenSSL securit

From the article, it's using OpenSSL in EDK II In fact, a whole section of the article is dedicated to talking about how they got tripped up by OpenSSL security level 3 rejecting 2048 bit RSA key