This post is about applying the latest patch for OpenSSL to protect our port 443 web traffic, not using ssh to log into these systems.

I went and obtained the lastest OpenSSL tarball source patch openssl-1.0.1g.tar.gz from here for my Linux workstation running CentOS 6.5, and built the patch, including

./config; make; make test; make install # as root

This installed in /usr/local/ssl.

I wanted to prove the patch out in a safe place, before applying it to our production systems. However, after running everything, I'm stumped. The

./config, make, make test, and make install

steps completed without errors.

How do I check that the latest OpenSSL is installed?

Here is the result of testing version from various answers:

openssl version -a
OpenSSL 1.0.1e-fips 11 Feb 2013
built on: Tue Apr  8 02:33:43 UTC 2014
platform: linux-elf
  • 1
    I see 2 down-votes for this question. It would be better if people let the OP know why they are down-voting the question, so that the OP can make his question more better. For me, it seems a good question only :)
    – Ramesh
    Commented Apr 24, 2014 at 15:39
  • 1
    @Ramesh Good observation. Perhaps the downvotes are from people who've presumed ssh is never dynamically linked to libssl?
    – goldilocks
    Commented Apr 24, 2014 at 16:00
  • @TAFKA'goldilocks', can't we make it mandatory to provide comments in case if someone is down-voting an answer? If someone is downvoting my question, I need to know what caused them to downvote. I am not saying they should not down-vote. If they provide the reason, it will give me an opportunity to fix the question and make it better. After all, we need better quality in the site :)
    – Ramesh
    Commented Apr 24, 2014 at 16:04
  • @Ramesh : I think you'd have to get that past the S.E. staff. Personally I disagree (you should be allowed to up/down vote anonymously, although it some cases you're right: it is not constructive without a comment). I think the only mandatory comment should be for the first close vote.
    – goldilocks
    Commented Apr 24, 2014 at 16:12
  • @TAFKA'goldilocks', agreed :)
    – Ramesh
    Commented Apr 24, 2014 at 16:15

3 Answers 3


Preamble: As observed in the question, openssl installs by default into /usr/local/ssl. My recommendation is to use ./config --prefix=/usr/local shared (notice the space before "shared") so that it installs there (and builds the shared library, libssl), rather than its own private subdirectory. If you do not do this, you will have to add a file to /etc/ld.so.conf.d with /usr/local/ssl/lib in it (see below for the significance of /etc/ld.so.conf.d files), and add /usr/local/bin to $PATH.

You will need to run ldconfig after make install to add the libraries to the linker cache. If that doesn't work, read on.

make install probably by default went to /usr/local, which should take precedence but may not. You can thus leave your distro's openssl install to avoid messing around with the package manager and prereqs, but still use your own locally built version as the default. To check:

ldd $(which ssh) | grep libssl

If you get no output, your ssh was statically linked and needs to be rebuilt (see Anton's answer). Otherwise, this should point to your /usr/local version. If it points to something else:

ldconfig -p | grep libssl

The /usr/local version should be shown, but after some other one. If so, skip down to "/usr/local/lib does not have precedence" below. If not, make sure /usr/local is in the linker path generally:

ldconfig -p | grep "/usr/local"

If not, grep -r "/usr/local" /etc/ld.so.conf.d. If that is not there, add a file to /etc/ld.so.conf.d called 00-local.conf with one line:


Run ldconfig (no switches) and go through this again.

/usr/local/lib does not have precedence

Find the linker cache config file where the path is added:

grep -r "/usr/local" /etc/ld.so.conf.d

If it's not there, you'll have to add a file as explained above. Presuming it is, the problem is the files are processed lexicographically. E.g., if the content of /etc/ld.so.conf.d is:


And libc.conf contains /usr/local/lib but addtheselibraries.conf contains, e.g. /usr/lib,1 then the latter will take precedence. If the /usr/local/lib file doesn't contain anything else, just rename it with something which will supersede the other files; numbers go first so 000-whatever is good.

Because you have complete control over /usr/local/lib, it should take precedence over any paths used by the distro package manager (and usually does).

1. /usr/lib is a default compiled into the linker, but it and other standard system places (/lib, etc) are added last, which allows you to supersede them. Because of these, sometimes (e.g.) /usr/lib is added to a .conf file in order to make it supersede some other .conf file.

openssl version -a

The above command will give you the version of openssl in the system. Check the build date rather than the date on the first line.


You will have to recompile openssh, by downloading the source including the openssl source in the source tree and run ./config; make; make install for openssh as well.

Detailed instructions on compiling openssh can be found in the INSTALL document

  • ssh should link to libssl and not need to be rebuilt. You can check this with ldd /usr/bin/ssh, presuming that's where it is.
    – goldilocks
    Commented Apr 24, 2014 at 14:29
  • 1
    @TAFKA'goldilocks' ldd $(which ssh) | fgrep ssl gives no output, so the executable (which is in /usr/bin) doesn't seem to be dynamically linked against ssl.
    – Anthon
    Commented Apr 24, 2014 at 14:44
  • 1
    That seems to be the case on debian, yeah, maybe as a (dubious and in this case ill conceived) security measure. It's dynamically linked on fedora. +1
    – goldilocks
    Commented Apr 24, 2014 at 14:54
  • Added more information per suggestions. Commented Apr 24, 2014 at 15:11
  • 1
    @octopusgrabbus For the bleeding heart bug you shouldn't need to upgrade ssh. If you want your ssh -V to show the latest OpenSSL version, as per your OP, then you need to recompile (or at least I did need to compile on Ubuntu).
    – Anthon
    Commented Apr 24, 2014 at 15:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .