It&#x27;s not <i>used</i>, exactly. It&#x27;s more of a historical accident.<p>Way back when, Apple shipped OpenSSL libraries as part of the OS and included them in the SDK. Naturally, some apps were built that used them.<p>Then Apple discovered that they couldn&#x27;t really upgrade the OpenSSL they shipped with the OS, because OpenSSL doesn&#x27;t maintain binary compatibility. They could ship a new version, but they were stuck shipping the old version as well, and the new version would suffer the same fate.<p>So instead, they reimplemented what they saw as the important functionality, shipped that as CommonCrypto and Security.framework, and deprecated OpenSSL to try to get people to stop using it. But they still ship it with the OS, because they don&#x27;t want to break whatever apps do still use it. And they can&#x27;t upgrade it, because that would defeat the whole purpose of shipping it.