As of Homebrew f4d2141 there is a --force option.

brew cleanup --force openssl

References: man brew

If you're using Homebrew /usr/local/bin should already be at the front of $PATH or at least come before /usr/bin. If you now run brew link --force openssl in your terminal window, open a new one and run which openssl in it. It should now show openssl under /usr/local/bin.

For what it's worth, I just used homebrew (http://brew.sh/):

brew update  
brew install openssl  
brew link --force openssl 
openssl version -a  

If one of the bad versions come up (1.0.1a-f), you can figure out which version of openssl you're using, this way:

which openssl

Often this is from /usr/bin. To make sure you get the updated version, drop a symlink into /usr/local/bin to point to the updated openssl, like this:

ln -s /usr/local/Cellar/openssl/1.0.1g/bin/openssl /usr/local/bin/openssl

As an alternative to that final step, some people replace the openssl in /usr/bin with a symlink to /usr/local/Cellar/openssl/1.0.1g/bin/openssl (or whatever your version is):

mv /usr/bin/openssl /usr/bin/openssl_OLD  
ln -s /usr/local/Cellar/openssl/1.0.1g/bin/openssl /usr/bin/openssl

But this is known to cause problems with some more recent versions of OSX. Better to just insert a new symlink into /usr/local/bin, which should take precedence on your path over /usr/bin.

Just do

brew unlink openssl

That will remove the symlinks that were created when running brew link.

MacOS includes an older version of openssl, that's what's by default in the path, and that's the one you'll see (try which openssl to see which one gets picked up on your computer).

Homebrew installs [email protected] into /opt, which means you need to explicitly call it from there, and if you want to link other programs you compile to it, you need to set library paths etc.

Same for libressl.

I just want to use the latest openssl (or libressl).

The binary, I assume? One way to do that is to add your own $HOME/bin directory in front of your PATH (something I recommend anyway) in your shell, and make a shell script openssl in there that calls the version you want to use. When you do it that way, you won't mess up anything else.

may that imply that some other software depending on that specific version will no longer work?

Exactly. That's why you shouldn't replace the one that comes with MacOS, for example.

Can I instruct software depending older openssl versions to use a specific path for that older version,

If you do it the other way round (have a different PATH in your terminal), then anything you call from outside the terminal isn't going to break, for starters.

To answer questions in the comment:

1. I have a ~/.profile with

   export PATH=$HOME/bin:$PATH
   

   in it.

2. See this answer. That is: Create a file ~/bin/openssl with

   #!/bin/bash
   exec /usr/local/opt/libressl/bin/openssl "$@"
   

in it. Don't forget to chmod a+x ~/bin/openssl.

Environment will get passed, redirections will apply. Wildcards will be resolved on first call, but passed on in resolved form.