0

I'm using Debian (Stretch). Here openssl version returns:

OpenSSL 1.1.0f 25 May 2017 (Library: OpenSSL 1.1.0-pre6-dev xx XXX xxxx)

  1. How can I update the "Library" used for OpenSSL (1.1.0-pre6-dev) to a most recent version since apt-get install openssl does not seem to help?

  2. On a different server, openssl version returns "OpenSSL 1.1.0g 2 Nov 2017 (Library: OpenSSL 1.1.0f 25 May 2017)": how is that possible that the version library used is not the same as the package installed?

Update 1

apt-cache policy openssl libssl1.1 output is:

openssl:

Installed: 1.1.0f-3+deb9u1
Candidate: 1.1.0f-3+deb9u1

Version table:
1.1.0f-3+deb9u1 500
500 http://security.debian.org/debian-security stretch/updates/main amd64 Packages
100 /var/lib/dpkg/status

1.1.0f-3 500
500 http://debian.mirrors.ovh.net/debian stretch/main amd64 Packages

libssl1.1:

Installed: 1.1.0f-5

Candidate: 1.1.0f-5

Version table:

1.1.0f-5 100
100 /var/lib/dpkg/status

1.1.0f-3+deb9u1 500
500 http://security.debian.org/debian-security stretch/updates/main amd64 
Packages

1.1.0f-3 500
500 http://debian.mirrors.ovh.net/debian stretch/main amd64 Packages

Update 2

It appears there are two versions of openssl installed:

usr/local/ssl/bin/openssl version returns OpenSSL 1.0.2h 3 May 2016

usr/bin/openssl version returns OpenSSL 1.1.0f 25 May 2017 (Library: OpenSSL 1.1.0-pre6-dev xx XXX xxxx)

which openssl returns /usr/bin/openssl

ldd $(which openssl) returns

linux-vdso.so.1 (0x00007fff3b074000)
libssl.so.1.1 => /usr/local/lib/libssl.so.1.1 (0x00007f4ec0de0000)
libcrypto.so.1.1 => /usr/local/lib/libcrypto.so.1.1 (0x00007f4ec095b000)
libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f4ec0757000)
libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f4ec053a000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f4ec019b000)
            /lib64/ld-linux-x86-64.so.2 (0x00007f4ec12f9000)
  • Why do you want a newer version? – Stephen Kitt Nov 16 '17 at 12:36
  • because it seems to be the reason why I can't compile Nginx from source with http2 module and ssl module – Vincent Nov 16 '17 at 12:57
  • Are you sure you’re using Stretch? What does apt-cache policy openssl libssl1.1 output? (Please edit your question to add the information.) Stretch only has 1.1.0f, but that’s newer than 1.1.0-pre6. – Stephen Kitt Nov 16 '17 at 13:17
  • I just edited the question with the ouput requested, many thanks for your help – Vincent Nov 16 '17 at 14:10
  • Weird... What do which openssl and ldd $(which openssl) output? It looks like there’s another version of both the openssl tool and the libssl library installed. – Stephen Kitt Nov 16 '17 at 14:51
3

First of all, you should remove the locally-installed libraries and binaries (libcrypto, libssl etc., and openssl). This will ensure that you use the packaged versions, which are the ones receiving security support.

To get what you’re really after, i.e. Nginx with HTTP2 and TLS, I highly recommend you use the backported package instead of building your own; that version has the features you’re looking for. To do so, run (as root)

echo deb http://http.debian.net/debian stretch-backports main > /etc/apt/sources.list.d/stretch-backports.list
apt update
apt install -t stretch-backports nginx
  • Dear Stephen, many thanks for your continuous follow up on this issue, your precise answers put me on the right track. Seriously, thank you! – Vincent Nov 16 '17 at 19:50
1

Debian Stretch is the current stable version (as at November 2017). The security team backports security fixes to the released code versions, so while you will not get new features you can be reasonably sure that your SSL libraries are up to date.

What related packages are, or could be, installed

dpkg -l '*openssl*'

What versions of installed packages are available in the repositories

dpkg -l '*openssl*' | awk '/^i/{print $2}' | xargs apt-show-versions -a

Ensure everything's up to date

apt-get update
apt-get upgrade

For any given package you can see which patches have been applied by reading the Changes file in /usr/share/doc/{package_name}/changelog.Debian.gz. For example,

zless /usr/share/doc/openssl/changelog.Debian.gz
0

It looks like you're using some Linux distro which means your packages updates depend on your distro maintainers and you'll get new versions of packages only when the said maintainers push new versions to your distro repository (it might also involve upgrading to a new version of your distro).

Of course you can follow e.g. this manual (if you're on Ubuntu/Debian/Mint) to build a new version of OpenSSL and then use dpkg to install it, but it may lead to dire consequences, for instance your installed applications will either stop connecting using SSL or stop working altogether.

If you absolutely need to have a new version of OpenSSL just to play with, you may compile it from sources and install to /usr/local where it won't interfere with system wide packages. That's usually as simple as running

./configure && make && make install

But nowadays it's not always straightforward considering the existence of CMake and other build chains. Anyways, a lot of Linux applications come with a manual how to build them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.