It seems that on macOS since Mojave (OSX 10.14.3), the -ssl option had been deprecated from RSA Utils (rsautl command) on it's default OpenSSL.

$ sw_vers
ProductName:    Mac OS X
ProductVersion: 10.14.3
BuildVersion:   18D42
$ openssl version
LibreSSL 2.6.5

Where can I get these update releases info? I googled the net but couldn't find them...

If I try to use -ssl option then it returns the help as an error. But the -ssl option is still there.

$ openssl rsautl -encrypt -pubin -inkey id_rsa.pub.pkcs8 -ssl -in test.txt -out test.txt.enc
Usage: rsautl [options]
-in file        input file
-out file       output file
-inkey file     input key
-keyform arg    private key format - default PEM
-pubin          input is an RSA public
-certin         input is a certificate carrying an RSA public key
-ssl            use SSL v2 padding
-raw            use no padding
-pkcs           use PKCS#1 v1.5 padding (default)
-oaep           use PKCS#1 OAEP
-sign           sign with private key
-verify         verify with public key
-encrypt        encrypt with public key
-decrypt        decrypt with private key
-hexdump        hex dump output

But in the manual, the -ssl option doesn't appear.

$ man openssl 
     openssl rsautl [-asn1parse] [-certin] [-decrypt] [-encrypt] [-hexdump] [-in
     file] [-inkey file] [-keyform der | pem] [-oaep | -pkcs | -raw] [-out file]
     [-pubin] [-sign] [-verify]

I understand that since SSL v2 is no longer good to use, they deprecated the -ssl option.

But I need some kind of confirmation about this so to let my client know and change their protocol to send encrypted files.

I noticed that the man was updated today (my time, Jan 29, 2019, Tokyo).

$ man openssl | tail -1
BSD                      January 29, 2019                       BSD

So I thought that Apple just forgot to update the -help, but even in the Mojave release notes there was no info about it.

Where can I get info of these changes and/or report to update the --help?

  • The LibreSSL site is at libressl.org and it contains changelogs for all versions of LibreSSL. – Kusalananda Jan 29 '19 at 8:06

I think I found where. And seems that it wasn't the Apple's issue but LibreSSL's OpenBSD issue. I'm sorry Apple.

In the latest commit's source code below, there still was the -ssl option.

I think this is the place to see the changes and report an issue.

  • This looks like a documentation bug. The actual code that uses this option was removed in August 2017: github.com/libressl-portable/openbsd/commit/… I might file a bug report with a patch against the base OpenBSD tree. – Kusalananda Jan 29 '19 at 8:57
  • This has been fixed now, but it'll take some time before Apple updates its OpenSSL. Your bug report was ever so slightly earlier than mine. – Kusalananda Jan 29 '19 at 11:33
  • @Kusalananda Thank you! Your report backed me up to tell my client that the documentation was wrong and all we have to do is wait! – KEINOS Jan 30 '19 at 7:01
  • ... and on my OpenBSD-current system, I can now see that openssl has indeed been fixed. – Kusalananda Jan 31 '19 at 12:43
  • @Kusalananda Thanks announcing me. I confirmed the fix too! github.com/libressl-portable/openbsd/commit/… – KEINOS Feb 1 '19 at 3:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.