I need to generate the libssl* and libcrypto* binaries for use on a different system. I wrote a trivial script doing it


set -evx


/bin/rm -fr $TARGET
curl -O -L http://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz
tar -xvzf openssl-$OPENSSL_VERSION.tar.gz
./Configure linux-x86_64 -shared

Everything seems to work, in the end I get the two libraries. Unfortunately, they're called libssl.so.1.0.0 and libcrypto.so.1.0.0. I'm rather confused...

Is it just a chaotic versioning or what's going on?

How can I find out what exactly was produced? Should I trust it?

In case it matters: My system is "Linux 4.4.0-116-generic #140-Ubuntu SMP Mon x86_64 GNU/Linux".

  • The 1.0.2l is the version of the OpenSSL distribution while 1.0.0 is the shared library version. I'm not sure I understand what's strange about this. There's no reason to bump the shared library version if the API has not changed.
    – Kusalananda
    Apr 4 '18 at 8:14
  • @Kusalananda I've seen a couple of systems (Mint or Fedora; I can't recall) having 1.0.2l or alike installed, while there was no 1.0.0 there. I'm pretty sure about that as our program trying to load 1.0.0 found nothing at all. Pretty confusing, isn't it?
    – maaartinus
    Apr 4 '18 at 8:40
  • The API versions went from 0.9.8 to 1.0.0 to 1.1.0 (the most recent version), there was never a 1.0.2 API and letters are not used on shared libraries.
    – Kusalananda
    Apr 4 '18 at 8:46
  • I'm not saying that it was the API version. However, I've just downloaded openssl-1.0.2o.tar.gz.
    – maaartinus
    Apr 4 '18 at 8:52

Yes, that is correct, the libraries will have version 1.0.0 even though the software package will have version 1.0.2l. That's because all versions 1.0.x of the software implement the same API (same functions with the same function signatures/prototypes), so the libraries should be versioned the same since users of those libraries can use these versions interchangeably.

The version of the libraries is defined here in the source tree. There's a comment just above that define that explains it a little bit further.

I hope that answers your question.

  • I don't understand why they're doing it, when symlinking libssl.so -> libssl.so.1.0.0 -> libssl.so.1.0.2l would work equally well and keep the information about the real version. Anyway, I understand that I can use the files, thank you.
    – maaartinus
    Apr 4 '18 at 8:48
  • @maaartinus You're still confusing the version of the OpenSSL distribution with the shared library version. There is no 1.0.2l OpenSSL API. 1.0.0 is "the real shared library version".
    – Kusalananda
    Apr 4 '18 at 9:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.