[Solved] Compile with OpenSSL 3.x.x support

Hi,

I'm trying to compile the latest release (lighttpd_1.4.76-3) and upgrade mod_openssl from using openssl 1.1.1w to 3.0.8 but when checking the library I see :

ldd mod_openssl.so
        linux-vdso.so.1 (0xbec56000)
        libssl.so.1.1 => /lib/arm-linux-gnueabihf/libssl.so.1.1 (0xb6e99000)
        libcrypto.so.1.1 => /lib/arm-linux-gnueabihf/libcrypto.so.1.1 (0xb6cdd000)
        libc.so.6 => /lib/arm-linux-gnueabihf/libc.so.6 (0xb6bde000)
        /lib/ld-linux-armhf.so.3 (0xb6f18000)
        libpthread.so.0 => /lib/arm-linux-gnueabihf/libpthread.so.0 (0xb6bb8000)
        libdl.so.2 => /lib/arm-linux-gnueabihf/libdl.so.2 (0xb6ba5000)

The resulting packages are installing fine but once I enable the ssl module and restarting the service I get :

/usr/sbin/lighttpd -tt -f /etc/lighttpd/lighttpd.conf
2024-05-16 19:09:14: (plugin.c.221) dlopen() failed for: /usr/lib/lighttpd/mod_openssl.so /usr/lib/lighttpd/mod_openssl.so: undefined symbol: ERR_new
2024-05-16 19:09:14: (server.c.1649) loading plugins finally failed

The new version of OpenSSL was installed using the steps from this article (https://orcacore.com/install-openssl-3-debian-11/)
Compiled lighttpd using the details from https://redmine.lighttpd.net/projects/1/wiki/InstallFromSource#distro-packaging-external-examples

Details about the system :

Linux orangepizero 6.1.63-current-sunxi #1 SMP Mon Nov 20 10:52:19 UTC 2023 armv7l GNU/Linux

cat /etc/os-release
PRETTY_NAME="Armbian 23.8.1 bullseye" 
NAME="Debian GNU/Linux" 
VERSION_ID="11" 
VERSION="11 (bullseye)" 
VERSION_CODENAME=bullseye
ID=debian
HOME_URL="https://www.armbian.com" 
SUPPORT_URL="https://forum.armbian.com" 
BUG_REPORT_URL="https://www.armbian.com/bugs" 
ARMBIAN_PRETTY_NAME="Armbian 23.8.1 bullseye" 

openssl version -a
OpenSSL 3.0.8 7 Feb 2023 (Library: OpenSSL 3.0.8 7 Feb 2023)
built on: Thu May 16 15:17:42 2024 UTC
platform: linux-armv4
options:  bn(64,32)
compiler: gcc -fPIC -pthread -march=armv7-a -Wa,--noexecstack -Wall -O3 -DOPENSSL_USE_NODELETE -DOPENSSL_PIC -DOPENSSL_BUILDING_OPENSSL -DNDEBUG
OPENSSLDIR: "/usr/local/ssl" 
ENGINESDIR: "/usr/local/lib/engines-3" 
MODULESDIR: "/usr/local/lib/ossl-modules" 
Seeding source: os-specific
CPUINFO: OPENSSL_armcap=0x1

Is there something I'm missing or anybody has any idea how to transition to the a more current version of OpenSSL?

Thank you,
Razvan

Replies (3)

RE: Compile with OpenSSL 3.x.x support - Added by gstrauss 11 months ago

Is there something I'm missing or anybody has any idea how to transition to the a more current version of OpenSSL?

The best solution is to avoid ancient, poorly maintained distros. Your life would be much easier if you were using a more modern version of armbian based on a more modern version of Debian, e.g. Debian Bookworm.

If you can't upgrade the system, then using the the lighttpd instructions to build a debian package builds against the system openssl. While there are ways to override this, that is effort spent fighting with the Debian intergration. It would be better to just upgrade the system.

However, since you do not seem to want to update the system, you should build lighttpd following the more basic build commands examples and specify the paths to find your build of openssl headers and openssl libraries. Then, once you build and link against your specified location of openssl includes and libraries, you can set LD_LIBRARY_PATH to the library location of openssl. Set LD_LIBRARY_PATH in the script environment you use to start the lighttpd executable to tell lighttpd where to find those libraries.

RE: Compile with OpenSSL 3.x.x support - Added by yo6nam 11 months ago

Thanks for your input, gstrauss.

Debian Bullseye is near EOL, but it's not ancient :)

I went ahead and compiled from GitHub using

./configure -C --prefix=/usr --with-openssl --with-openssl-libs=/usr/local/lib --with-openssl-includes --disable-static --enable-shared

Cheers!

RE: Compile with OpenSSL 3.x.x support - Added by gstrauss 11 months ago

Debian Bullseye is near EOL, but it's not ancient :)

LOL. Then why do you need to upgrade from openssl 1.1.1w? Is it because openssl 1.1.1 is EOL? (yes) https://endoflife.date/openssl openssl.org support for openssl 1.1.1 ended Sep 2023.

Anyway, I am glad you found a solution. Upgrading from an older Debian release may sometimes be another solution.

(1-3/3)

Project

General

Profile

Lighttpd