As someone who has actually had no choice but to write code that uses OpenSSL libraries: if you're going to reimplement a proper TLS stack, you might as well ac

As someone who has actually had no choice but to write code that uses OpenSSL libraries: if you're going to reimplement a proper TLS stack, you might as well actually spend time to design the API properly. (And use some less insane crypto library instead.) OpenSSL is used because it has a lot of inertia, and because it still has had a lot of testing. Any new library would need to have an imperial buttload of extremely aggressive tests with near-complete coverage from the start to be even considered an option. Even then the uphill battle to unseat OpenSSL will be long and arduous. Being simply superior and easier to use is not enough. You have to convince an industry, worth tens or hundreds of billions, to actually see big enough a benefit to even consider your implementation as a viable option. So in addition to economical realities you would still have a massive hurdle ahead: getting crypto right is hard. Really, really hard. Sure enough, there are alternatives to OpenSSL. But unfortunately it's like having to choose between varieties of cancer or STD's. You don't like the any of the choices, and in fact, you would prefer not to be in a position to have to make the choice in the first place.