[bsergean]

OpenSSL builds with deprecated declarations hidden fail on legacy initialization, locking, ECDH, and certificate getter APIs. On current master, OPENSSL_NO_DEPRECATED with a 3.0 API compatibility level reproduces the four errors in #518 and an additional error for SSL_get_peer_certificate.

Compile the legacy initialization calls, locking callback/mutexes, and ECDH setup only for OpenSSL before 1.1. Modern versions already use OPENSSL_init_ssl. On OpenSSL 3, use SSL_get1_peer_certificate, preserving the owned reference and existing X509_free behavior; older OpenSSL and LibreSSL keep their existing getter.

Add make -f makefile.dev test_openssl_no_deprecated and CI jobs against Debian Bullseye's OpenSSL 1.1.1 and Bookworm's OpenSSL 3.0. Both build the library, CLI, and complete test suite with deprecated APIs hidden and deprecated declarations treated as errors. The Bullseye job uses Debian's archived repositories for the older packages. The target overrides cached TLS backend selections and rediscovers cached OpenSSL library/header paths.

Give test credential generation its own minimal OpenSSL configuration. OpenSSL 1.1.1 otherwise combines the system's CA extension with -addext, generating duplicate Basic Constraints and invalid test certificates. This keeps verification enabled and provides valid credentials on both versions.

Validation:

• The unmodified backend fails with the reported missing APIs when compatibility declarations are hidden.
• With the fix, backend compilation passes against OpenSSL 1.1.1w and 3.6.3, with both default settings and deprecated APIs hidden.
• Full C++11 builds and all 24 suites pass for each version with deprecated APIs hidden, including TLS server and pending-write tests.
• The new make target passes all 24 suites against OpenSSL 3.6.3. Updated credentials verify with OpenSSL 1.1.1; the OpenSSL 3 TLS suite also passes after regeneration.
• All 12 CI checks pass, including the new OpenSSL 1.1.1 and 3.0 jobs, existing OpenSSL/SecureTransport/Mbed TLS TSAN jobs, ASAN, native macOS, Windows, DLL consumers, and 32-bit consumers.
• Actionlint, formatting, and git diff --check pass.

References: OpenSSL initialization, certificate getter ownership and compatibility.

Closes #518.