2

When I do openssl version, I get the following information

OpenSSL 1.1.0j  20 Nov 2018 (Library: OpenSSL 1.1.0k  28 May 2019)

What does this difference between the j and the Library k version mean here?

I tried updating openssl by doing apt-get update && apt-get install openssl and after which when I do a openssl version, I get the following:

OpenSSL 1.1.0k  28 May 2019

BTW I am new to using Linux and so a bit confused about these versioning details.

1 Answer 1

3

OpenSSL is primarily a library: a collection of subroutines that programs can use. It's actually two libraries which come together: /usr/lib/libcrypto.so.1.1 which contains subroutines related to cryptographic primitives and certificate management, and /usr/lib/libssl.so.1.1 which contains subroutines related to the TLS protocol. The 1.1 part in the file name is part of the library version, and the directory containing those files can vary (for example, on Ubuntu for 64-bit PC, it's /usr/lib/x86_64-linux-gnu). Those libraries come as part of the libssl1.1 package on Debian/Ubuntu and derived distributions (again, 1.1 is the relevant part of the version number).

OpenSSL also comes with a command-line tool /usr/bin/openssl which provides a command line interface to functionality from the libcrypto and libssl libraries. It can be used to benchmark cryptographic primitives, to manipulate keys and certificates, to run some tests, etc. It can even be used to do things like encrypt data, but the interface is not at all geared towards real-world use: it's too low-level and most of the ways to use it are insecure. The command line tool comes as part of the openssl package.

The reason the library package is separate from the package containing the command line program is the same reason why the library package contains a part of the version number and the library files also contain that. It's possible to install multiple versions of the library, and you need to do that if you have programs built for different versions of the ABI of the library. On the other hand, you can only install one openssl command.

1.1.0j and 1.1.0k are two different versions of OpenSSL that are close enough to have compatible ABIs. Typically, when a program's version is structured as numbers with dots in between, an increment in a number towards the left represents a major change, while an incremenet in a number towards the right represents a very minor change such as a bug fix. OpenSSL tends to make significant changes with increments of the rightmost number or even the letter, which is somewhat unusual.

Normally you'd have the same version of the command line tool and the library, plus possibly some legacy library versions for programs built with an older ABI. For example, Ubuntu 18.04 ships OpenSSL 1.1.1, but it also provides libssl1.0.0 containing version 1.0.2 of the libraries for programs built with the ABI of 1.0.0 which 1.0.2 remains compatible with. On an up-to-date system, the openssl program is always from the same version as the library that it uses, because they both come from the same source package. But on a system that isn't up-to-date, you might have already upgraded the library to 1.1.0k but still have a slightly older version of the command line executable 1.1.0j.

1
  • Thanks a lot for the detailed answer!
    – Kiran
    Aug 8, 2019 at 0:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.