compiling curl with openssl giving wrong openssl version

Question

I have found various answers on this, but I can't get anything that works for me. I am trying to compile curl with nghttp2 on my CentOS server.

I have compiled it all ok, but my problem is that curl -V is showing the wrong openssl version:

curl 7.51.0-DEV (x86_64-unknown-linux-gnu) libcurl/7.51.0-DEV
OpenSSL/1.0.1e zlib/1.2.3 nghttp2/1.16.0-DEV
Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s
rtsp smb smbs smtp smtps telnet tftp 
Features: IPv6 Largefile NTLM NTLM_WB SSL libz HTTP2 UnixSockets

When I do openssl version, it reports:

OpenSSL 1.0.2h  3 May 2016

Can anyone help me to fix this please (I am out of my comfort zone here!)? From what I understand, http2 is not working correctly because openssl needs to be 1.0.2.

Thanks

EDIT

I have tried changing my configure to this:

./configure  --with-nghttp2=/usr/local --with-ssl=/var/tmp/openssl-1.0.2h
 CPPFLAGS="-I/var/tmp/openssl-1.0.2h/include/openssl" 
 LDFLAGS="-L/var/tmp/openssl-1.0.2h"

But now the configure doesn't complete:

error: one or more libs available at link-time are not available run-time. 
Libs used at link-time: -lnghttp2   -lssl -lcrypto -lz -lrt

The issue is definitely with the openssl linking, as I can configure ok using --without-ssl. I suppose, my paths must be wrong - but I am not sure what they should be pointing to?

I guess it's statically linked so the source package on the machine where you compiled it on is what matters (I think). — phk, Oct 22, 2016 at 18:46
Thanks for you response, but how do I link to the correct one? — markt, Oct 23, 2016 at 12:01
How did you configure OpenSSL? Also, usually you want to set CFLAGS in addition to CPPFLAGS. CPPFLAGS is the C preprocessor, and it often is not added to CFLAGS and CXXFLAGS. I believe include directory should be -I/var/tmp/openssl-1.0.2h/include (omit the trailing openssl). When you configure OpenSSL, add an RPATH: ./Configure linux-x86_64 -Wl,-rpath,/var/tmp/openssl-1.0.2h/lib. Do you really run OpenSSL form /var/tmp? — user56041, Nov 8, 2016 at 11:29
Thanks for your response. I did manage to get this working a couple of weeks ago - pretty much how you described here except I installed openssl in /usr/local/ssl instead of /var/tmp! — markt, Nov 8, 2016 at 13:24

score 1 · Accepted Answer · 2016-11-09 07:23:05Z

I think the trick here is you need to get all three components (OpenSSL, ngHTTP and cURL) to use the freshly built OpenSSL. The easiest way is to use an RPATH, and its the -Wl,-rpath,/usr/local/lib shown blow.

Build OpenSSL

OpenSSL does not honor CFLAGS, so you need to add -Wl,-rpath,/usr/local/lib to your configure line. It explains flags like ec_nistp_64_gcc_128.

Also see Compilation and Installation on the OpenSSL wiki.

$ wget https://www.openssl.org/source/openssl-1.1.0b.tar.gz
$ tar xzf openssl-1.1.0b.tar.gz

$ cd openssl-1.1.0b
$ ./Configure linux-x86_64 shared no-ssl2 no-ssl3 no-comp enable-ec_nistp_64_gcc_128 -Wl,-rpath,/usr/local/lib
Configuring OpenSSL version 1.1.0b (0x0x1010002fL)
***** Deprecated options: no-ssl2
...
SIXTY_FOUR_BIT_LONG mode
Configured for linux-x86_64.

$ make -j 4
...
$ sudo make install
...

$ /usr/local/bin/openssl version
OpenSSL 1.1.0b  26 Sep 2016

$ ldd /usr/local/bin/openssl 
    linux-vdso.so.1 =>  (0x00007ffcd27e0000)
    libssl.so.1.1 => /usr/local/lib/libssl.so.1.1 (0x00007fe8f8740000)
    libcrypto.so.1.1 => /usr/local/lib/libcrypto.so.1.1 (0x00007fe8f8294000)
    ...

CFLAGS and CXXFLAGS

Now that a new OpenSSL is available, you need the rest of the components to use it. The minor wrinkle ngHTTP uses both gcc and g++, so you ned to tune both CFLAGS and CXXFLAGS.

Personally, I don't mess with CPPFLAGS, which is flags to the C preprocessor. Its the compiler driver's job to pass them down to the preprocessor when required.

$ export CFLAGS="-I/usr/local/include/ -L/usr/local/lib -Wl,-rpath,/usr/local/lib -lssl -lcrypto"
$ export CXXFLAGS="-I/usr/local/include/ -L/usr/local/lib -Wl,-rpath,/usr/local/lib -lssl -lcrypto"

Build nghttp2

The special item here is setting both CFLAGS and CXXFLAGS.

$ wget https://github.com/nghttp2/nghttp2/releases/download/v1.16.0/nghttp2-1.16.0.tar.gz
$ tar xzf nghttp2-1.16.0.tar.gz
$ cd nghttp2-1.16.0

$ CFLAGS="$CFLAGS" CXXFLAGS="$CXXFLAGS" ./configure
...
    Compiler:
      C compiler:     gcc
      CFLAGS:         -I/usr/local/include/ -L/usr/local/lib -Wl,-rpath,/usr/local/lib -lssl -lcrypto
      LDFLAGS:        
      C++ compiler:   g++
      CXXFLAGS:       -I/usr/local/include/ -L/usr/local/lib -Wl,-rpath,/usr/local/lib -lssl -lcrypto
...
    Libs:
      OpenSSL:        yes (CFLAGS='-I/usr/local/include' LIBS='-L/usr/local/lib -lssl -lcrypto')
    ...

$ make -j 4
...
$ sudo make install
...

Libraries have been installed in:
   /usr/local/lib
...

Build cURL

Nothing really special here. cURL will use the CFLAGS, too.

$ wget https://curl.haxx.se/download/curl-7.51.0.tar.gz
$ tar xzf curl-7.51.0.tar.gz

$ cd curl-7.51.0
$ ./configure --help | egrep '(ssl|tls|nghttp2)'
  --enable-tls-srp        Enable TLS-SRP authentication
  --disable-tls-srp       Disable TLS-SRP authentication
  --with-winssl           enable Windows native SSL/TLS
  --without-winssl        disable Windows native SSL/TLS
  --with-darwinssl        enable Apple OS native SSL/TLS
  --without-darwinssl     disable Apple OS native SSL/TLS
  --with-ssl=PATH         Where to look for OpenSSL, PATH points to the SSL
                          installation (default: /usr/local/ssl); when
  --without-ssl           disable OpenSSL
  --with-gnutls=PATH      where to look for GnuTLS, PATH points to the
  --without-gnutls        disable GnuTLS detection
  --with-polarssl=PATH    where to look for PolarSSL, PATH points to the
  --without-polarssl      disable PolarSSL detection
  --with-mbedtls=PATH     where to look for mbedTLS, PATH points to the
  --without-mbedtls       disable mbedTLS detection
  --with-cyassl=PATH      where to look for CyaSSL, PATH points to the
  --without-cyassl        disable CyaSSL detection
  --with-axtls=PATH       Where to look for axTLS, PATH points to the axTLS
  --without-axtls         disable axTLS
  --with-nghttp2=PATH     Enable nghttp2 usage
  --without-nghttp2       Disable nghttp2 usage

$ ./configure --with-ssl=/usr/local --with-nghttp2=/usr/local
checking whether to enable maintainer-specific portions of Makefiles... no
checking whether make supports nested variables... yes
...
checking for egrep... /bin/grep -E
checking for ar... /usr/bin/ar
configure: using CFLAGS: -I/usr/local/include/ -L/usr/local/lib -Wl,-rpath,/usr/local/lib -lssl -lcrypto
...
configure: Configured to build curl/libcurl:

  curl version:     7.51.0
  Host setup:       x86_64-pc-linux-gnu
  Install prefix:   /usr/local
  Compiler:         gcc
  SSL support:      enabled (OpenSSL)
  SSH support:      no      (--with-libssh2)
  zlib support:     no      (--with-zlib)
  GSS-API support:  no      (--with-gssapi)
  TLS-SRP support:  enabled
  resolver:         default (--enable-ares / --enable-threaded-resolver)
  IPv6 support:     enabled
  Unix sockets support: enabled
  IDN support:      no      (--with-{libidn2,winidn})
  Build libcurl:    Shared=yes, Static=yes
  Built-in manual:  enabled
  --libcurl option: enabled (--disable-libcurl-option)
  Verbose errors:   enabled (--disable-verbose)
  SSPI support:     no      (--enable-sspi)
  ca cert bundle:   /etc/ssl/certs/ca-certificates.crt
  ca cert path:     no
  ca fallback:      no
  LDAP support:     no      (--enable-ldap / --with-ldap-lib / --with-lber-lib)
  LDAPS support:    no      (--enable-ldaps)
  RTSP support:     enabled
  RTMP support:     no      (--with-librtmp)
  metalink support: no      (--with-libmetalink)
  PSL support:      no      (libpsl not found)
  HTTP2 support:    enabled (nghttp2)
  Protocols:        DICT FILE FTP FTPS GOPHER HTTP HTTPS IMAP IMAPS POP3 POP3S RTSP SMB SMBS SMTP SMTPS TELNET TFTP

$ make -j 4
...
$ sudo make install
...

Verify Libraries

After all the hoops, verify things. Especially important is the RPATH so you don't have to waste time with LD_LIBRARY_PATH. -Wl,-rpath,/usr/local/lib ensures the path with the proper shared objects are dialed into the executable.

$ which curl
/usr/local/bin/curl

$ ldd /usr/local/bin/curl
    linux-vdso.so.1 =>  (0x00007ffcd0ffd000)
    libcurl.so.4 => /usr/local/lib/libcurl.so.4 (0x00007f86ad8a4000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f86ad4c4000)
    libnghttp2.so.14 => /usr/local/lib/libnghttp2.so.14 (0x00007f86ad293000)
    libssl.so.1.1 => /usr/local/lib/libssl.so.1.1 (0x00007f86ad025000)
    libcrypto.so.1.1 => /usr/local/lib/libcrypto.so.1.1 (0x00007f86acb79000)
    /lib64/ld-linux-x86-64.so.2 (0x0000560d3d474000)
    libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f86ac95b000)
    libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f86ac757000)

Finally:

$ /usr/local/bin/curl -V
curl 7.51.0 (x86_64-pc-linux-gnu) libcurl/7.51.0 OpenSSL/1.1.0b nghttp2/1.16.0
Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp smb smbs smtp smtps telnet tftp 
Features: IPv6 Largefile NTLM NTLM_WB SSL TLS-SRP HTTP2 UnixSockets

You can cleanup with:

$ cd ..
$ rm -rf curl-7.51.0* nghttp2-1.16.0* openssl-1.1.0b*
...

Stack Exchange Network

current community

your communities

more stack exchange communities

compiling curl with openssl giving wrong openssl version

1 Answer 1

Your Answer

Not the answer you're looking for? Browse other questions tagged centos curl openssl or ask your own question.

Linked

Hot Network Questions

compiling curl with openssl giving wrong openssl version

1 Answer 1

Your Answer

Sign up or log in

Post as a guest

Not the answer you're looking for? Browse other questions tagged centos curl openssl or ask your own question.

Linked

Related

Hot Network Questions