Support

Last time I checked most if not all all payment gateways were still using SSL certificates signed with SHA-1 sums for their API systems and only SHA-256 signed certificates for the user-facing systems. In fact the first payment gateway to upgrade their certificates is PayPal and the upgrade only goes into effect June 17th 2016. Everybody else is sticking with the PCI (Payment Card Industry) revised timeline of late 2017. So, being able to connect to payment gateways means absolutely nothing about your libcURL and libssl except that they are updated sometime in the last 4 years :D

Here's the problem with old, SHA-1 signed certificates. They are now reported as invalid (red bar) in Chrome and Firefox because SHA-1 has known cryptographic attacks against it, meaning that an attacker can spoof an SHA-1 signed certificate with a very modest cost. That's no bueno: it's insecure and would make us look bad. This is why as soon as we saw that we upgraded our SSL certificate. That was a few months ago. However, this now meant that you need the PHP cURL module compiled against libcurl 0.40.0 or later which is in turn must be compiled against libssl (OpenSSL) 1.0.1c or later. Anything lower and you can't access our HTTPS update provisioning site because it's too secure for old versions of OpenSSL and cURL (oh, the irony...).

So, you should update OpenSSL, libcurl and the PHP curl module, in this order. Not only it doesn't cause a security issue on your server, it actually makes it more secure and ensures that it will be able to communicate with third party secure servers in the future as security measures get tighter.