How to get openssl to work on Debian 9.5

Question

This is my distribution I use

  root@ci-server:~/temp# lsb_release -a
    No LSB modules are available.
    Distributor ID: Debian
    Description:    Debian GNU/Linux 9.5 (stretch)
    Release:        9.5
    Codename:       stretch

When installing openssl I receive the following message but using openssl just simply does not work

root@ci-server:~/temp# apt-get install openssl
Reading package lists... Done
Building dependency tree
Reading state information... Done
openssl is already the newest version (1.1.0j-1~deb9u1).
0 upgraded, 0 newly installed, 0 to remove and 17 not upgraded.
root@ci-server:~/temp# openssl version
openssl: error while loading shared libraries: libcrypto.so.1.1: cannot open shared object file: No such file or directory

but libcrypto.so.1.1 was found here

root@ci-server:~/temp# find / -name "libcrypto.so.1.1"
/usr/lib64/libcrypto.so.1.1

ldconfig contents

root@ci-server:~# cat /etc/ld.so.conf
include /etc/ld.so.conf.d/*.conf

and

root@ci-server:~# ls -l /etc/ld.so.conf.d/
total 12
-rw-r--r-- 1 root root 38 Jan 17  2017 fakeroot-x86_64-linux-gnu.conf
-rw-r--r-- 1 root root 44 Mar 20  2016 libc.conf
-rw-r--r-- 1 root root 68 Jan 14  2018 x86_64-linux-gnu.conf

looking for /usr/lib64 within /etc/ld.so.conf.d did not yield any results

root@ci-server:~# grep -irl "/usr/lib64" /etc/ld.so.conf.d/
root@ci-server:~#

Answer 1

The expected location for libcrypto.so.1.1 in Debian 9.5 is /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1, not /usr/lib64... and the package that contains it is libssl1.1, which contains the libraries of OpenSSL; in Debian packaging, the openssl package contains only the configuration files, the /usr/bin/openssl and /usr/bin/c_rehash command binaries and the associated man pages. The openssl package (and anything that requires OpenSSL libraries) depends on libssl1.1. This way, the package management allows you to install just the libraries if you don't need the openssl command-line tool and are building e.g. an embedded system with minimal amount of storage space available.

On a fresh installation of Debian 9.x on x86_64 architecture, /usr/lib64 should not even exist. The fact that it exists suggests that another copy of openssl may have been installed from some alternative source (perhaps by copying the binaries from another host, or by installing packets intended for other distributions).

Please run dpkg --verify libssl1.1 openssl to verify the integrity of libssl1.1 and openssl packages on your system. The output will list any files that have been modified: if e.g. the /usr/bin/openssl binary is listed in the output, you'll know that your system's openssl has been tampered with.

The worst-possible scenario is that your system has been hacked and the intruder has tried to replace your OpenSSL with a modified version that will leak your private keys to the intruder. If so, then the intruder made a mistake, probably by using a set of libraries intended for RHEL/CentOS/Fedora-style systems (where the /usr/lib64 path is typically used) on your Debian system.

If you think your system might be hacked: don't panic. Server Fault has a canonical answer on what to do if you suspect your server has been compromised by a hacker.