4

I need to install openssl 1.0 on debian 9 (stretch). when I run apt-get install openssl , version 1.1 is installed by default.

how can I change the repository in order to install an old version of openssl?

  • 1
    You will probably instead need to download openssl sources by yourself and compile it to make sure you have exactly what you need. I hope that you have valid reasons to need version 1.0 (what broke in 1.1 that you can not use it?) because compiling such things by itself is not funny. – Patrick Mevzek Jan 25 '18 at 21:25
  • Can you please summarize how to do it? I'm still new to debian :) – user123 Jan 25 '18 at 21:36
  • Check which versions your sources.list entries can see - apt-cache madison openssl. If you want a non-default version, use apt-get install packagename=specificversion - ie, apt-get install openssl=1.0.2g-1ubuntu4 (on my Mint 18 system) – ivanivan Jan 25 '18 at 21:47
  • why do you exactly need an old openssl version? – Rui F Ribeiro Jan 25 '18 at 22:07
  • Do you need the old version of the programs (and if-so why) or do you just need the old library? – plugwash Jan 25 '18 at 22:53
7

As others have mentioned, if you can use OpenSSL 1.1 instead, that would be best.

However, if you really do need OpenSSL 1.0, the answer depends on your exact requirement. If you only need the OpenSSL library, and if version 1.0.2 is appropriate, then you can install libssl1.0.2 from Debian 9 and be done with it.

If you need version 1.0 of the openssl tool, or version 1.0.1 of the library, the simplest option on Debian 9 is to install it from Debian 8 (which still receives security updates, and will until 2020). To do so, create a file called /etc/apt/sources.list.d/jessie.list containing the following:

deb http://httpredir.debian.org/debian jessie main contrib non-free
deb-src http://httpredir.debian.org/debian jessie main contrib non-free

deb http://security.debian.org/ jessie/updates main contrib non-free
deb-src http://security.debian.org/ jessie/updates main contrib non-free

Then run sudo apt update, and apt install openssl/jessie for the openssl tool, or apt install libssl1.0.0 for the library.

Contrary to some people’s claims, you don’t risk breaking your system by installing these packages, thanks to package management and properly-defined package dependencies.

  • 1
    With the risk of major breakage among all packages, as other installed Debian 9 packages will have a dependency on libssl1.1 (>= 1.1.0)... – Patrick Mevzek Jan 25 '18 at 22:42
  • @Patrick, no, because libssl1.0.0 is co-installable with libssl1.1. I have this exact setup on a couple of systems, one in particular which is used to track the 1.0-to-1.1 transition, and it works fine. – Stephen Kitt Jan 26 '18 at 5:19
  • TBH I find it rather amusing that you claim this risks breaking other packages, while you recommend recompiling from source in your own answer... – Stephen Kitt Jan 26 '18 at 5:40
  • I clearly did not wrote things correctly enough if that is your interpretation of my answer. You clearly miss both my intent and my explanation, sorry about that. – Patrick Mevzek Jan 26 '18 at 6:10
  • Version 1.0.1 is not supported anymore by upstream OpenSSL. Only 1.0.2 is, until end of 2019. libssl1.0.0 in your repository seems to be a port of openssl 1.0.1t in fact . No trace of a 1.0.2 version. Based on packages.debian.org/… there seem to be a backport of some 1.0.2 version in jessie-backports repository. – Patrick Mevzek Apr 12 '18 at 0:03
1

I do not know if you will find older versions of a software, such as openssl, for newer version of your distribution, as most of the time it will not make sense, as newer versions should fix problems, etc. (they are exceptions of course). Alternatively, why not use Debian 8 directly?

But have a look at https://serverfault.com/questions/108080/ubuntu-debian-show-list-of-available-versions-of-a-specific-package and the apt-show-versions and rmadison tools.

So first you have to really make sure you absolutely need an old version. You do not detail your use case, so hard to give good advises.

What you can always do is install from the sources themselves... but it is not a simple task. The compilation by itself may not be a huge deal, but you need to install it separately from the system part, like in /usr/local and for something typically used as a library by other applications, you need to recompile the other applications to make sure to use your local version instead of the system one. You will have a similar problem if you happen to find an old package that suits your needs: other applications on the system relying on openssl might not work anymore and the software list on your system may be broken.

In short make really absolutely sure without alternatives that you need to do that!

And if you never compiled anything on a Linux system (it will be mostly the same in all distributions), openssl is maybe not the best candidate for first try.

Go to https://www.openssl.org/source/ and download the version you need (I do hope that you find it here, because otherwise you will have an even bigger problem).

As with other software, start with README that basically tells you to read INSTALL. And it boils down to:

 $ ./config
 $ make
 $ make test
 $ make install

But please make sure to read the file before doing anything as it has important information, like where the software will be installed.

Then you need to be able to use the result in whatever application you need it... but you do not give context of your question, so I can not help you. Often you will need to recompile other software with a flag such as --with-openssl=DIRECTORY to force it to use your version instead of the normal system one.

  • The API of openssl changes a lot between versions...if some old software needs it, a new version is not a drop in replacement. – Rui F Ribeiro Jan 25 '18 at 22:07
  • @RuiFRibeiro can you pinpoint a specific breakage/change of API between 1.0 and 1.1? I agree in general with your assertion but in that specific case it is better to upgrade the old software (again, general vow, not always trivial indeed) instead of downgrading openssl, especially for such a security critical code with so many bugs discovered in the past years... – Patrick Mevzek Jan 25 '18 at 22:10
  • I have not said it a good idea to use the old versions, and I fully agree with you. I know there are huge API differences between some versions mainly because of dealing with freeradius, however I am not that familiar with the openssl libraries. – Rui F Ribeiro Jan 25 '18 at 22:12
  • There are huge differences between the APIs of OpenSSL 1.0 and 1.1 — some of them are listed on the OpenSSL wiki. Converting software from 1.0 to 1.1 can be quite difficult... – Stephen Kitt Jan 25 '18 at 22:17
  • 1
    Please don’t spread FUD, 1.0 still gets security support. – Stephen Kitt Jan 25 '18 at 22:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.