Why not? When you&#x27;re running a service like this, <i>thinking</i> instead of <i>checking</i> is not a wise move.<p>How much time would it have taken to whip up a script that just tests all of the apps in the store? Even if it&#x27;s a week of an engineer&#x27;s time, that seems worthwhile. Testing whether the apps in the store actually run when presented with a valid receipt should <i>already</i> be automated anyway.<p>I&#x27;m looking through Apple&#x27;s guidance here:<p><a href="https:&#x2F;&#x2F;developer.apple.com&#x2F;library&#x2F;mac&#x2F;releasenotes&#x2F;General&#x2F;ValidateAppStoreReceipt&#x2F;Chapters&#x2F;ValidateLocally.html" rel="nofollow">https:&#x2F;&#x2F;developer.apple.com&#x2F;library&#x2F;mac&#x2F;releasenotes&#x2F;General...</a><p>The only thing they say about which version of OpenSSL to use is that you need to bring your own and not rely on the one that ships with the OS, because Apple is still shipping a version of OpenSSL from 2005. They do not say anything about which version of OpenSSL you need to use or what capabilities it needs to have.<p>I bet a lot of people were using Apple&#x27;s OpenSSL for this originally, and when it was deprecated the path of least resistance would have been to bundle the same version Apple ships.