2

I'm using Debian (Stretch). Here openssl version returns:

OpenSSL 1.1.0f 25 May 2017 (Library: OpenSSL 1.1.0-pre6-dev xx XXX xxxx)

  1. How can I update the "Library" used for OpenSSL (1.1.0-pre6-dev) to a most recent version since apt-get install openssl does not seem to help?

  2. On a different server, openssl version returns "OpenSSL 1.1.0g 2 Nov 2017 (Library: OpenSSL 1.1.0f 25 May 2017)": how is that possible that the version library used is not the same as the package installed?

Update 1

apt-cache policy openssl libssl1.1 output is:

openssl:

Installed: 1.1.0f-3+deb9u1
Candidate: 1.1.0f-3+deb9u1

Version table:
1.1.0f-3+deb9u1 500
500 http://security.debian.org/debian-security stretch/updates/main amd64 Packages
100 /var/lib/dpkg/status

1.1.0f-3 500
500 http://debian.mirrors.ovh.net/debian stretch/main amd64 Packages

libssl1.1:

Installed: 1.1.0f-5

Candidate: 1.1.0f-5

Version table:

1.1.0f-5 100
100 /var/lib/dpkg/status

1.1.0f-3+deb9u1 500
500 http://security.debian.org/debian-security stretch/updates/main amd64 
Packages

1.1.0f-3 500
500 http://debian.mirrors.ovh.net/debian stretch/main amd64 Packages

Update 2

It appears there are two versions of openssl installed:

usr/local/ssl/bin/openssl version returns OpenSSL 1.0.2h 3 May 2016

usr/bin/openssl version returns OpenSSL 1.1.0f 25 May 2017 (Library: OpenSSL 1.1.0-pre6-dev xx XXX xxxx)

which openssl returns /usr/bin/openssl

ldd $(which openssl) returns

linux-vdso.so.1 (0x00007fff3b074000)
libssl.so.1.1 => /usr/local/lib/libssl.so.1.1 (0x00007f4ec0de0000)
libcrypto.so.1.1 => /usr/local/lib/libcrypto.so.1.1 (0x00007f4ec095b000)
libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f4ec0757000)
libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f4ec053a000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f4ec019b000)
            /lib64/ld-linux-x86-64.so.2 (0x00007f4ec12f9000)
Improve this question
8
  • Why do you want a newer version? Commented Nov 16, 2017 at 12:36
  • because it seems to be the reason why I can't compile Nginx from source with http2 module and ssl module Commented Nov 16, 2017 at 12:57
  • Are you sure you’re using Stretch? What does apt-cache policy openssl libssl1.1 output? (Please edit your question to add the information.) Stretch only has 1.1.0f, but that’s newer than 1.1.0-pre6. Commented Nov 16, 2017 at 13:17
  • I just edited the question with the ouput requested, many thanks for your help Commented Nov 16, 2017 at 14:10
  • Weird... What do which openssl and ldd $(which openssl) output? It looks like there’s another version of both the openssl tool and the libssl library installed. Commented Nov 16, 2017 at 14:51

3 Answers 3

Reset to default
4

First of all, you should remove the locally-installed libraries and binaries (libcrypto, libssl etc., and openssl). This will ensure that you use the packaged versions, which are the ones receiving security support.

To get what you’re really after, i.e. Nginx with HTTP2 and TLS, I highly recommend you use the backported package instead of building your own; that version has the features you’re looking for. To do so, run (as root)

echo deb http://http.debian.net/debian stretch-backports main > /etc/apt/sources.list.d/stretch-backports.list
apt update
apt install -t stretch-backports nginx
Improve this answer
1
  • 1
    Dear Stephen, many thanks for your continuous follow up on this issue, your precise answers put me on the right track. Seriously, thank you! Commented Nov 16, 2017 at 19:50
1

Debian Stretch is the current stable version (as at November 2017). The security team backports security fixes to the released code versions, so while you will not get new features you can be reasonably sure that your SSL libraries are up to date.

What related packages are, or could be, installed

dpkg -l '*openssl*'

What versions of installed packages are available in the repositories

dpkg -l '*openssl*' | awk '/^i/{print $2}' | xargs apt-show-versions -a

Ensure everything's up to date

apt-get update
apt-get upgrade

For any given package you can see which patches have been applied by reading the Changes file in /usr/share/doc/{package_name}/changelog.Debian.gz. For example,

zless /usr/share/doc/openssl/changelog.Debian.gz
Improve this answer
0

It looks like you're using some Linux distro which means your packages updates depend on your distro maintainers and you'll get new versions of packages only when the said maintainers push new versions to your distro repository (it might also involve upgrading to a new version of your distro).

Of course you can follow e.g. this manual (if you're on Ubuntu/Debian/Mint) to build a new version of OpenSSL and then use dpkg to install it, but it may lead to dire consequences, for instance your installed applications will either stop connecting using SSL or stop working altogether.

If you absolutely need to have a new version of OpenSSL just to play with, you may compile it from sources and install to /usr/local where it won't interfere with system wide packages. That's usually as simple as running

./configure && make && make install

But nowadays it's not always straightforward considering the existence of CMake and other build chains. Anyways, a lot of Linux applications come with a manual how to build them.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.