Re: Its mostly C ....
Have a look at some of the other OpenSSL code - whilst it undoubtedly does what it is meant to do, there's no way in hell that it'd pass any decent code review.
Admittedly, crypto is probably the sort of thing that's done by mathematicians rather than 'professional' developers but whoever is responsible for that monumental clusterfuck of preprocessor directives and eye-tearingly bad coding style needs taking aside, given a book on coding standards and a serious beating with a Clue Stick.
Given how difficult it can be to get anything done with OpenSSL, I'm amazed it has gained as much traction as it has.
If APIs could speak, OpenSSL would be screaming 'fuck you!'