4

Nginx's error log shows some OpenSSL Handshake errors and while searching for the cause I found confusing outputs of what OpenSSL version is used.

Details:
Debian Jessie 8.7 64 Bit

# apt-cache policy openssl
openssl:
  Installed: 1.0.1t-1+deb8u6
  Candidate: 1.0.1t-1+deb8u6
  Version table:
     1.0.2k-1~bpo8+1 0
        100 http://ftp.debian.org/debian/ jessie-backports/main amd64 Packages
 *** 1.0.1t-1+deb8u6 0
        500 http://security.debian.org/ jessie/updates/main amd64 Packages
        100 /var/lib/dpkg/status
     1.0.1t-1+deb8u5 0
        500 http://mirror.hetzner.de/debian/packages/ jessie/main amd64 Packages
        500 http://http.debian.net/debian/ jessie/main amd64 Packages

# apt-cache policy nginx
nginx:
  Installed: 1.9.10-1~bpo8+4
  Candidate: 1.10.3-1~bpo8+1
  Version table:
     1.10.3-1~bpo8+1 0
        100 http://ftp.debian.org/debian/ jessie-backports/main amd64 Packages
 *** 1.9.10-1~bpo8+4 0
        100 /var/lib/dpkg/status
     1.6.2-5+deb8u4 0
        500 http://mirror.hetzner.de/debian/packages/ jessie/main amd64 Packages
        500 http://http.debian.net/debian/ jessie/main amd64 Packages
        500 http://security.debian.org/ jessie/updates/main amd64 Packages

# nginx -V
nginx version: nginx/1.9.10
built with OpenSSL 1.0.2j  26 Sep 2016 (running with OpenSSL 1.0.2k  26 Jan 2017)

# openssl version -a
OpenSSL 1.0.1t  3 May 2016 (Library: OpenSSL 1.0.2k  26 Jan 2017)

How can nginx runs with openssl 1.0.2k and openssl version -a says that the Library is OpenSSL 1.0.2k but apt-cache policy openssl says installed is 1.0.1t ?

Could someone shed some light, please?

3
  • What does apt-cache policy nginx output? – Stephen Kitt Mar 7 '17 at 17:55
  • @StephenKitt I updated the post. The output of apt-cache policy nginx is really strange because I am sure that I also installed it from jessie-backports some weeks ago. – Hamburml Mar 7 '17 at 17:58
  • 1
    Questions like unix.stackexchange.com/questions/23799/… seem to indicate that nginx can be built with OpenSSL integrated as source. Maybe yours was build that way. Sure would be a PITA if openssl had a bug and you couldn't update it as a libarary though – infixed Mar 7 '17 at 19:13
5

The openssl package contains the front-end binary, not the library. You're tracking Jessie for that package (with its security updates).

The library itself is libssl1.0.0, and you're tracking Jessie backports for that package (along with Nginx; you're just a few versions behind for the latter). This is what Nginx uses, and is the library version identified by the openssl front-end. You can see the version of the library on your system with

apt-cache policy libssl1.0.0

(as well as the availability of newer versions, if any).

2
  • apt-cache policy libssl1.0.0 says 1.0.2k-1~bpo8+1 0 is installed. Could you please explain the difference between the front-end binary (which is version 1.0.1t-1+deb8u6) and the library? When is the binary and when the library used? Sorry if this sounds too stupid, I just want to make everything right. – Hamburml Mar 7 '17 at 20:07
  • 1
    The library contains the implementations of the SSL-related features (and anything else warranted by the OpenSSL API). The front-end binary provides command-line access to those features, for use interactively or in shell scripts. Other applications can use those features too, by linking to the library; this is what Nginx does. For Nginx the only thing that matters is the OpenSSL library, the openssl front-end isn't used. – Stephen Kitt Mar 7 '17 at 22:05
-2

I suspect that nginx -V shows which version of openssl was used to build the kernel, and that it is also showing you the version on the system that it's using.

2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.