> So what? OpenSSL is publically available. Have your installer (or
> the user) download it when needed. If you want to ship it with your
> application, just be sure to host the files on a non-US server (I'm no
> lawyer, but that should protect you from US export laws on
> encryption).
No, hosting on a non-US server will not necessarily protect you from US
export laws if you are an American citizen or an American company doing
business outside of the US.
While I am not a lawyer either, even providing the "hooks" in your
application to provide encryption can get you into trouble if you are
not careful.
Before you export a cryptographic application from the US be sure that
you are compliance with the law. Consult with a lawyer familiar with
the ITAR (or newer legislation) to be safe.
