IMO the best way to install openssl on MacOS is to use Homebrew. This will not only install openssl, but will also allow it to be upgraded in the future.

brew install openssl

If you want to make the Homebrew version the default (rather than the LibreSSL that comes with MacOS), you will also need put the Hombrew-installed openssl on your path ahead of the MacOS version. While it is possible to accomplish this by putting /opt/homebrew/bin on your PATH ahead of /usr/bin, I strongly discourage this, because it makes you vulnerable to unintentionally installing a malicious Homebrew package named something like ls that overrides your default ls with malicious code. Instead, my personal preference is to have a user-level directory where I maintain a small set of binaries that override the defaults.

# Create a user-level bin directory, if it doesn't already exist.
mkdir -p ~/bin

# Create a symlink to the Homebrew openssl, if such a symlink does not already exist
ln -fs /opt/homebrew/bin/openssl ~/bin/openssl

Then, put ~/bin on your PATH, ahead of /usr/bin. This part depends on which shell you are using. For bash, you can add this to your ~/.bash_profile.

# User-level binaries, manually added
PATH="${HOME}/bin:${PATH}"

Execute following commands:

brew update
brew install openssl
echo 'export PATH="/usr/local/opt/openssl/bin:$PATH"' >> ~/.bash_profile
source ~/.bash_profile

You will have the latest version of openssl installed and accessible from cli (command line/terminal). Since the third command will add export path to .bash_profile, the newly installed version of openssl will be accessible across system restarts.

For what it's worth, I just used homebrew (http://brew.sh/):

brew update  
brew install openssl  
brew link --force openssl 
openssl version -a  

If one of the bad versions come up (1.0.1a-f), you can figure out which version of openssl you're using, this way:

which openssl

Often this is from /usr/bin. To make sure you get the updated version, drop a symlink into /usr/local/bin to point to the updated openssl, like this:

ln -s /usr/local/Cellar/openssl/1.0.1g/bin/openssl /usr/local/bin/openssl

As an alternative to that final step, some people replace the openssl in /usr/bin with a symlink to /usr/local/Cellar/openssl/1.0.1g/bin/openssl (or whatever your version is):

mv /usr/bin/openssl /usr/bin/openssl_OLD  
ln -s /usr/local/Cellar/openssl/1.0.1g/bin/openssl /usr/bin/openssl

But this is known to cause problems with some more recent versions of OSX. Better to just insert a new symlink into /usr/local/bin, which should take precedence on your path over /usr/bin.