diff --git a/admin/cli/generate_key.php b/admin/cli/generate_key.php
index 28fd0af3660..9d5e8e5294b 100644
--- a/admin/cli/generate_key.php
+++ b/admin/cli/generate_key.php
@@ -39,6 +39,8 @@ if ($unrecognized) {
     cli_error(get_string('cliunknowoption', 'admin', $unrecognized));
 }
 
+// TODO: MDL-71421 - Remove the openssl alternative once sodium becomes a requirement in Moodle 4.2.
+
 if ($options['help']) {
     echo "Generate secure key
 
diff --git a/admin/environment.xml b/admin/environment.xml
index 495db2b5079..6f2e8a30f62 100644
--- a/admin/environment.xml
+++ b/admin/environment.xml
@@ -3447,7 +3447,7 @@
       </PHP_EXTENSION>
       <PHP_EXTENSION name="hash" level="required"/>
       <PHP_EXTENSION name="fileinfo" level="required"/>
-      <PHP_EXTENSION name="sodium" level="required"/>
+      <PHP_EXTENSION name="sodium" level="optional"/>
     </PHP_EXTENSIONS>
     <PHP_SETTINGS>
       <PHP_SETTING name="memory_limit" value="96M" level="required">
diff --git a/lib/classes/encryption.php b/lib/classes/encryption.php
index 84560f68993..aff8599e4e5 100644
--- a/lib/classes/encryption.php
+++ b/lib/classes/encryption.php
@@ -30,10 +30,15 @@ namespace core;
  * @package core
  * @copyright 2020 The Open University
  * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @deprecated since Moodle 3.11 MDL-71420 - the openssl part of the class only.
+ * @todo MDL-71421 Remove the openssl part in Moodle 4.2.
  */
 class encryption {
     /** @var string Encryption method: Sodium */
     const METHOD_SODIUM = 'sodium';
+
+    // TODO: MDL-71421 - Remove the following openssl constants and all uses once sodium becomes a requirement in Moodle 4.2.
+
     /** @var string Encryption method: hand-coded OpenSSL (less safe) */
     const METHOD_OPENSSL = 'openssl-aes-256-ctr';
 
diff --git a/lib/upgrade.txt b/lib/upgrade.txt
index b4d58ee3f61..df17134a6ab 100644
--- a/lib/upgrade.txt
+++ b/lib/upgrade.txt
@@ -79,6 +79,8 @@ information provided here is intended especially for developers.
   default the key is stored in moodledata but admins can configure a different, more secure
   location in config.php if required. To get the best possible security for this feature, we
   recommend enabling the Sodium PHP extension.
+  The OpenSSL alternative for this API, used when Sodium is not available, is considered deprecated
+  at all effects, and will be removed in Moodle 4.2. See MDL-71421 for more information.
 * Behat timeout constants behat_base::TIMEOUT, EXTENDED_TIMEOUT, and REDUCED_TIMEOUT, which were deprecated in 3.7, have been removed.
 * \core_table\local\filter\filterset::JOINTYPE_DEFAULT is being changed from 1 (ANY) to 2 (ALL). Filterset implementations
   can override the default filterset join type by overriding \core_table\local\filter\filterset::get_join_type() instead.