iRedMail-1.4.0 switched to OpenSSL.

In /etc/make.conf, find line "DEFAULT_VERSIONS =", replace "ssl=libressl" by "ssl=openssl". Next time you upgrade packages via ports tree, it will switch to openssl.

UPDATE:  I was able to migrate from LibreSSL to OpenSSL, but not without a few gotchas.  Here's the steps I followed:

(As always before starting make sure the ports are up-to-date with a "portsnap auto")

1.  Update make.conf and change ssl=libressl to ssl=openssl in the following section:

# iRedMail-DEFAULT_VERSIONS
DEFAULT_VERSIONS=ssl=openssl python=3.8 python2=2.7 python3=3.8 pgsql=12 php=7.4

2.  Replace the LibreSSL port with the OpenSSL port using portmaster

# portmaster -o security/openssl security/libressl

This was a critical step to "replace" the port instead of just installing OpenSSL.  In my original attempt, I didn't do this an just installed OpenSSL which created too many problems and I had to rollback my server from a snapshot and start over.  So, my advice is do not install OpenSSL first.  Just do this.

3.  Update all dependencies

# portmaster -R -r openssl-1.1.1k_1,1

This process failed several times due to missing libraries.  In my case, the failures and missing libraries were related to these ports:
- archivers/libarchive
- ftp/curl
- databases/mariadb104-client

4.  Fix broken dependencies using this process in each port's directory: (for example)

# cd /usr/ports/archivers/libarchive
# make
# make deinstall install clean

And, generally follow this same process for the other broken dependencies from step 3.

5.  For ftp/curl, I had to do this:

# cd /usr/ports/ftp/curl
# make all-depends-list

Then, for each port from that list, I re-installed it with portmaster.  For example:

# portmaster devel/kyua

There were 14 ports in total I needed to do this for, so I did this for each.

6.  Then, the original process from step 3, I was able to re-run until it finished without error*

*in my case, there was one small problem with a vulnerability with sogo that prevented it from building without adding this line to make.conf

DISABLE_VULNERABILITIES=yes

7.  Then, I checked for any other missing libraries using:

# pkg_libchk -qo

Which resulted in a few ports that I re-installed using portmaster.

8.  Finally, I ran portmaster to install any other ports that had not been updated:

# portmaster -a

9.  ..and restarted the server.  Verified everything was working correctly.

At this point, I also went back and removed the DISABLE_VULNERABILITIES flag from /etc/make.conf

Done!

For reference, I loosely followed some related approaches I found in this post and this post.