I think the trick here is you need to get all three components (OpenSSL, ngHTTP and cURL) to use the freshly built OpenSSL. The easiest way is to use an RPATH, and its the -Wl,-rpath,/usr/local/lib
shown blow.
Build OpenSSL
OpenSSL does not honor CFLAGS
, so you need to add -Wl,-rpath,/usr/local/lib
to your configure line. It explains flags like ec_nistp_64_gcc_128
.
Also see Compilation and Installation on the OpenSSL wiki.
$ wget https://www.openssl.org/source/openssl-1.1.0b.tar.gz
$ tar xzf openssl-1.1.0b.tar.gz
$ cd openssl-1.1.0b
$ ./Configure linux-x86_64 shared no-ssl2 no-ssl3 no-comp enable-ec_nistp_64_gcc_128 -Wl,-rpath,/usr/local/lib
Configuring OpenSSL version 1.1.0b (0x0x1010002fL)
***** Deprecated options: no-ssl2
...
SIXTY_FOUR_BIT_LONG mode
Configured for linux-x86_64.
$ make -j 4
...
$ sudo make install
...
$ /usr/local/bin/openssl version
OpenSSL 1.1.0b 26 Sep 2016
$ ldd /usr/local/bin/openssl
linux-vdso.so.1 => (0x00007ffcd27e0000)
libssl.so.1.1 => /usr/local/lib/libssl.so.1.1 (0x00007fe8f8740000)
libcrypto.so.1.1 => /usr/local/lib/libcrypto.so.1.1 (0x00007fe8f8294000)
...
CFLAGS and CXXFLAGS
Now that a new OpenSSL is available, you need the rest of the components to use it. The minor wrinkle ngHTTP uses both gcc
and g++
, so you ned to tune both CFLAGS
and CXXFLAGS
.
Personally, I don't mess with CPPFLAGS
, which is flags to the C preprocessor. Its the compiler driver's job to pass them down to the preprocessor when required.
$ export CFLAGS="-I/usr/local/include/ -L/usr/local/lib -Wl,-rpath,/usr/local/lib -lssl -lcrypto"
$ export CXXFLAGS="-I/usr/local/include/ -L/usr/local/lib -Wl,-rpath,/usr/local/lib -lssl -lcrypto"
Build nghttp2
The special item here is setting both CFLAGS
and CXXFLAGS
.
$ wget https://github.com/nghttp2/nghttp2/releases/download/v1.16.0/nghttp2-1.16.0.tar.gz
$ tar xzf nghttp2-1.16.0.tar.gz
$ cd nghttp2-1.16.0
$ CFLAGS="$CFLAGS" CXXFLAGS="$CXXFLAGS" ./configure
...
Compiler:
C compiler: gcc
CFLAGS: -I/usr/local/include/ -L/usr/local/lib -Wl,-rpath,/usr/local/lib -lssl -lcrypto
LDFLAGS:
C++ compiler: g++
CXXFLAGS: -I/usr/local/include/ -L/usr/local/lib -Wl,-rpath,/usr/local/lib -lssl -lcrypto
...
Libs:
OpenSSL: yes (CFLAGS='-I/usr/local/include' LIBS='-L/usr/local/lib -lssl -lcrypto')
...
$ make -j 4
...
$ sudo make install
...
Libraries have been installed in:
/usr/local/lib
...
Build cURL
Nothing really special here. cURL will use the CFLAGS
, too.
$ wget https://curl.haxx.se/download/curl-7.51.0.tar.gz
$ tar xzf curl-7.51.0.tar.gz
$ cd curl-7.51.0
$ ./configure --help | egrep '(ssl|tls|nghttp2)'
--enable-tls-srp Enable TLS-SRP authentication
--disable-tls-srp Disable TLS-SRP authentication
--with-winssl enable Windows native SSL/TLS
--without-winssl disable Windows native SSL/TLS
--with-darwinssl enable Apple OS native SSL/TLS
--without-darwinssl disable Apple OS native SSL/TLS
--with-ssl=PATH Where to look for OpenSSL, PATH points to the SSL
installation (default: /usr/local/ssl); when
--without-ssl disable OpenSSL
--with-gnutls=PATH where to look for GnuTLS, PATH points to the
--without-gnutls disable GnuTLS detection
--with-polarssl=PATH where to look for PolarSSL, PATH points to the
--without-polarssl disable PolarSSL detection
--with-mbedtls=PATH where to look for mbedTLS, PATH points to the
--without-mbedtls disable mbedTLS detection
--with-cyassl=PATH where to look for CyaSSL, PATH points to the
--without-cyassl disable CyaSSL detection
--with-axtls=PATH Where to look for axTLS, PATH points to the axTLS
--without-axtls disable axTLS
--with-nghttp2=PATH Enable nghttp2 usage
--without-nghttp2 Disable nghttp2 usage
$ ./configure --with-ssl=/usr/local --with-nghttp2=/usr/local
checking whether to enable maintainer-specific portions of Makefiles... no
checking whether make supports nested variables... yes
...
checking for egrep... /bin/grep -E
checking for ar... /usr/bin/ar
configure: using CFLAGS: -I/usr/local/include/ -L/usr/local/lib -Wl,-rpath,/usr/local/lib -lssl -lcrypto
...
configure: Configured to build curl/libcurl:
curl version: 7.51.0
Host setup: x86_64-pc-linux-gnu
Install prefix: /usr/local
Compiler: gcc
SSL support: enabled (OpenSSL)
SSH support: no (--with-libssh2)
zlib support: no (--with-zlib)
GSS-API support: no (--with-gssapi)
TLS-SRP support: enabled
resolver: default (--enable-ares / --enable-threaded-resolver)
IPv6 support: enabled
Unix sockets support: enabled
IDN support: no (--with-{libidn2,winidn})
Build libcurl: Shared=yes, Static=yes
Built-in manual: enabled
--libcurl option: enabled (--disable-libcurl-option)
Verbose errors: enabled (--disable-verbose)
SSPI support: no (--enable-sspi)
ca cert bundle: /etc/ssl/certs/ca-certificates.crt
ca cert path: no
ca fallback: no
LDAP support: no (--enable-ldap / --with-ldap-lib / --with-lber-lib)
LDAPS support: no (--enable-ldaps)
RTSP support: enabled
RTMP support: no (--with-librtmp)
metalink support: no (--with-libmetalink)
PSL support: no (libpsl not found)
HTTP2 support: enabled (nghttp2)
Protocols: DICT FILE FTP FTPS GOPHER HTTP HTTPS IMAP IMAPS POP3 POP3S RTSP SMB SMBS SMTP SMTPS TELNET TFTP
$ make -j 4
...
$ sudo make install
...
Verify Libraries
After all the hoops, verify things. Especially important is the RPATH so you don't have to waste time with LD_LIBRARY_PATH
. -Wl,-rpath,/usr/local/lib
ensures the path with the proper shared objects are dialed into the executable.
$ which curl
/usr/local/bin/curl
$ ldd /usr/local/bin/curl
linux-vdso.so.1 => (0x00007ffcd0ffd000)
libcurl.so.4 => /usr/local/lib/libcurl.so.4 (0x00007f86ad8a4000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f86ad4c4000)
libnghttp2.so.14 => /usr/local/lib/libnghttp2.so.14 (0x00007f86ad293000)
libssl.so.1.1 => /usr/local/lib/libssl.so.1.1 (0x00007f86ad025000)
libcrypto.so.1.1 => /usr/local/lib/libcrypto.so.1.1 (0x00007f86acb79000)
/lib64/ld-linux-x86-64.so.2 (0x0000560d3d474000)
libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f86ac95b000)
libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f86ac757000)
Finally:
$ /usr/local/bin/curl -V
curl 7.51.0 (x86_64-pc-linux-gnu) libcurl/7.51.0 OpenSSL/1.1.0b nghttp2/1.16.0
Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp smb smbs smtp smtps telnet tftp
Features: IPv6 Largefile NTLM NTLM_WB SSL TLS-SRP HTTP2 UnixSockets
You can cleanup with:
$ cd ..
$ rm -rf curl-7.51.0* nghttp2-1.16.0* openssl-1.1.0b*
...
CFLAGS
in addition toCPPFLAGS
.CPPFLAGS
is the C preprocessor, and it often is not added toCFLAGS
andCXXFLAGS
. I believe include directory should be-I/var/tmp/openssl-1.0.2h/include
(omit the trailingopenssl
). When you configure OpenSSL, add an RPATH:./Configure linux-x86_64 -Wl,-rpath,/var/tmp/openssl-1.0.2h/lib
. Do you really run OpenSSL form/var/tmp
? – user56041 Nov 8 '16 at 11:29