On Ubuntu 22,04: Upgraded OpenSSL from 3.0.2 to 3.0.7; `openssl version` command still shows 3.0.2 for library

Question

I have just manually upgraded OpenSSL from 3.0.2 to 3.0.7. I know a patch was available for 3.0.2, but, easier to answer to management this way vs. having to explain over and over again why the version still shows 3.0.2. So no need to comment on that.

I ran into the 'unable to lookup symbol BIO_f_zlib' error initially after the install when using:

config --prefix=/usr/local/ssl --openssldir=/usr/local/ssl share zlib

Changed the config to:

config --prefix=/usr/local/ssl --openssldir=/usr/local/ssl no-comp

and this was successful.

Now that my install is complete, I am seeing that the openssl version command is showing:

OpenSSL 3.0.7 1 Nov 2022 (Library: OpenSSL 3.0.2 15 Mar 2022)

How do I correct my installation so that the Library version matches the Binary version?
NOTE:

• I updated /etc/ld.so.conf.d with a file named openssl-3.0.7.conf with /usr/local/ssl/lib for contents.
• I have also changed the system environment PATH var to include /usr/local/ssl/bin.
• I executed ldconfig -v and source /etc/environment after the updates (no joy) and finally rebooted (still no joy).

Still seeing the mismatch in the openssl version output.

I tried the suggestion to re-link libssl.so.3, with no success.  See below environmental info and trailing openssl version output.  New OpenSSL (3.0.7) was installed to /usr/local/ssl per the config option on the build.

# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 22.04.1 LTS
Release:        22.04
Codename:       jammy

# find /usr/local -name 'libssl.so*'
/usr/local/qualys/cloud-agent/lib/libssl.so.1.1
/usr/local/qualys/cloud-agent/lib/libssl.so
/usr/local/ssl/lib64/libssl.so.3
/usr/local/ssl/lib64/libssl.so
/usr/local/lib64/libssl.so
/usr/local/lib64/libssl.so.3_3.0.2 <== renamed from libssl.so.3
/usr/local/src/openssl-3.0.7/libssl.so.3
/usr/local/src/openssl-3.0.7/libssl.so

# ls -l /usr/local/lib64/libssl.so*
lrwxrwxrwx 1 root root     32 Nov  2 17:07 /usr/local/lib64/libssl.so -> /usr/local/ssl/lib64/libssl.so.3
-rwxr-xr-x 1 root root 809464 Nov  1 15:55 /usr/local/lib64/libssl.so.3_3.0.2

# ls -l /usr/local/ssl/lib64/libssl.so*
lrwxrwxrwx 1 root root     11 Nov  1 21:23 /usr/local/ssl/lib64/libssl.so -> libssl.so.3
-rwxr-xr-x 1 root root 808704 Nov  1 21:23 /usr/local/ssl/lib64/libssl.so.3

# openssl version -a
OpenSSL 3.0.7 1 Nov 2022 (Library: OpenSSL 3.0.2 15 Mar 2022)

built on: Thu Oct 27 17:06:56 2022 UTC

platform: debian-amd64

options:  bn(64,64)

compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -Wa,--noexecstack -g -O2 -ffile-prefix-map=/build/openssl-WsPfAX/openssl-3.0.2=. -flto=auto -ffat-lto-objects -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -DOPENSSL_TLS_SECURITY_LEVEL=2 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_BUILDING_OPENSSL -DNDEBUG -Wdate-time -D_FORTIFY_SOURCE=2

OPENSSLDIR: "/usr/lib/ssl"

ENGINESDIR: "/usr/lib/x86_64-linux-gnu/engines-3"

MODULESDIR: "/usr/lib/x86_64-linux-gnu/ossl-modules"

Seeding source: os-specific

CPUINFO: OPENSSL_ia32cap=0xfefa32035f8bffff:0x1c2ffb

What have I missed and how can I make sure processes using the library are using the correct version library?

Answer 1

It appears that your OpenSSL binary was correctly upgraded to version 3.0.7, but the library is still pointing to the old version 3.0.2. To fix this, you need to update the library path to point to the new version.

First, check where your OpenSSL library is located. Based on your find command output, it seems to be in /usr/local/ssl/lib64/libssl.so.3.

Next, you need to update the library path for the system to look for the new version. You have already added /usr/local/ssl/lib to /etc/ld.so.conf.d/openssl-3.0.7.conf, but you need to also run the ldconfig command to update the library cache with the new path:

sudo ldconfig

This should update the library cache to include the new OpenSSL library path.

Finally, check if the library version has been updated by running:

ldd $(which openssl)

This should show the library path used by openssl. If it still shows the old version, try running ldd with the path to the openssl binary in /usr/local/ssl/bin.

If the library path has been updated, running openssl version should now show the correct version for both the binary and the library.

openssl version -a

I hope this helps!

Answer 2

Seems like your libraries are not updated. Beside updating OpenSSL you also would need to update corresponding libraries (libssl in this case). Best would be to:

apt update
apt upgrade

And manually updating OpenSSL may corrupt some of its usage - libraries will not fit to other on the system, so the best way to do that is by the two above commands. Your system may not be ready to support newer version of OpenSSL than in the repo.

The other way around is to manually update all libraries along. So if you first update OpenSSL manually, then update libssl manually and going further into other libraries - manually too. However you may end up with need to upgrade the whole system to newer edition what is obviously not advised.

Answer 3

The prefix=/usr/local/ssl is not the default OpenSSL isstalaltion prefix on Ubuntu 22. You now have a new version on /usr/local/ssl and a default one. You may try to build with the following options

export CONFARGS  = --prefix=/usr --openssldir=/usr/lib/ssl --libdir=lib/x86_64-linux-gnu no-idea no-mdc2 no-rc5 no-zlib no-ssl3 enable-unit-test no-ssl3-method enable-rfc3779 enable-cms no-capieng
    
./Configure shared $(CONFARGS)  linux-x86_64  && perl configdata.pm -d
make -j4 
make install 

Maybe create a .deb package and test it before installing.