ros2 moved to OpenSSL 1.1.1 on Linux but is still using 1.0.2 on Win10. Security should use latest version ... because security. 1.0.2 support was added to cyclonedds to accommodate ros2's Win10 dependency but we don't think it is the OpenSSL version that ros2 should be using.
Also ros2 CI build farm builds with OpenSSL DLL instead of statically linked lib. DLL can be a source of troubles. @eboasson can give more details if interested.