OpenSSL source code is a disaster. It's spaghetti that doesn't do what you think it does with horrible documentation. People submit patches from people they don't even know and then you have it: An SSL library that is flawed but everyone is using it. An spying agency and hackers dream.
We don't need OpenSSL, we need another library built from scratch with very clean code and documentation.
Everyone who has more interest on why OpenSSL is a catastrophe should watch operation ORCHESTRA[0].