173

I'm on: OSX 10.11.6, Homebrew version 0.9.9m OpenSSL 0.9.8zg 14 July 2015

I'm trying to play with with dotnetcore and by following their instructions,

I've upgraded/installed the latest version of openssl:

> brew install openssl
==> Downloading https://homebrew.bintray.com/bottles/openssl-1.0.2h_1.el_capitan.bottle.tar.gz
Already downloaded: /Users/administrator/Library/Caches/Homebrew/openssl-1.0.2h_1.el_capitan.bottle.tar.gz
==> Pouring openssl-1.0.2h_1.el_capitan.bottle.tar.gz
==> Caveats
A CA file has been bootstrapped using certificates from the system
keychain. To add additional certificates, place .pem files in
  /usr/local/etc/openssl/certs

and run
  /usr/local/opt/openssl/bin/c_rehash

This formula is keg-only, which means it was not symlinked into /usr/local.

Apple has deprecated use of OpenSSL in favor of its own TLS and crypto libraries

Generally there are no consequences of this for you. If you build your
own software and it requires this formula, you'll need to add to your
build variables:

    LDFLAGS:  -L/usr/local/opt/openssl/lib
    CPPFLAGS: -I/usr/local/opt/openssl/include

But when I try to link openssl I continue to run into this linking error:

> brew link --force openssl
Warning: Refusing to link: openssl
Linking keg-only OpenSSL means you may end up linking against the insecure,
deprecated system version while using the headers from the Homebrew version.
Instead, pass the full include/library paths to your compiler e.g.:
  -I/usr/local/opt/openssl/include -L/usr/local/opt/openssl/lib

The option to include compiler flags doesn't make sense to me, since I'm not compiling these libraries that I'm dependent on.

EDIT dotnetcore has updated their instructions:

brew update    
brew install openssl    
ln -s /usr/local/opt/openssl/lib/libcrypto.1.0.0.dylib /usr/local/lib/    
ln -s /usr/local/opt/openssl/lib/libssl.1.0.0.dylib /usr/local/lib/
11
  • 3
    For .NET Core you need a supported version of OpenSSL, which would be a 1.0.1 or 1.0.2 version. Since you're reporting a 0.9.8 version maybe you need to brew upgrade openssl first?
    – bartonjs
    Jul 30, 2016 at 5:32
  • 2
    I've already done that. I should have clarified, but I didn't add those steps to the question. But I've already done the brew update and brew install openssl. This is trying to install the supported version.
    – daviddeath
    Jul 30, 2016 at 5:59
  • 2
    Looks like Homebrew has explicitly blocked it: github.com/Homebrew/brew/commit/….
    – bartonjs
    Jul 30, 2016 at 6:10
  • 4
    And.. to continue rounding out my rambling, you might be interested in whatever develops on github.com/Homebrew/brew/pull/597
    – bartonjs
    Jul 30, 2016 at 6:28
  • 2
    "... when I try to link openssl I continue to run into this linking error:.." - Also see How to set the runtime path (-rpath) of an executable with gcc under Mac OSX?. It may help you always load the correct library at runtime, if Brew is not adding it.
    – jww
    Jul 30, 2016 at 11:53

15 Answers 15

73

This is what worked for me:

brew update
brew install openssl
ln -s /usr/local/opt/openssl/lib/libcrypto.1.0.0.dylib /usr/local/lib/
ln -s /usr/local/opt/openssl/lib/libssl.1.0.0.dylib /usr/local/lib/
ln -s /usr/local/Cellar/openssl/1.0.2j/bin/openssl /usr/local/bin/openssl

Thanks to @dorlandode on this thread https://github.com/Homebrew/brew/pull/597

NB: I only used this as a temporary fix until I could spend time correctly installing Openssl again from scratch. As I remember I spent best part of a day debugging and having issues before I realised the best way was to manually install the certs I needed one by one. Please read the link in @bouke's comment before attempting this.

6
  • 9
    is the full path for the last link /usr/local/bin/openssl? Oct 24, 2016 at 19:33
  • Why this answer is not accepted, you saved my life man. ::thumb up::
    – wukong
    Nov 22, 2016 at 19:15
  • 2
    There's a good reason brew is refusing to do this. See also this: github.com/Homebrew/brew/pull/597.
    – Bouke
    Jan 24, 2017 at 9:58
  • 9
    This solution worked for me, but I had to change 1.0.2j to 1.0.2k because of version differences. So users beware, you may need to adjust paths for the current version
    – Jeff
    Mar 27, 2017 at 14:25
  • I saw @Jeff's comment a little too late. If you did too, I believe ln -s -f /usr/local/Cellar/openssl/1.0.2k/bin/openssl /usr/local/bin/openssl fixes it Apr 13, 2017 at 15:43
63

As the update to the other answer suggests, the workaround of installing the old openssl101 brew will no longer work. For a right-now workaround, see this comment on dotnet/cli#3964.

The most relevant part of the issue copied here:

I looked into the other option that was suggested for setting the rpath on the library. I think the following is a better solution that will only effect this specific library.

sudo install_name_tool -add_rpath /usr/local/opt/openssl/lib /usr/local/share/dotnet/shared/Microsoft.NETCore.App/1.0.0/System.Security.Cryptography.Native.dylib

and/or if you have NETCore 1.0.1 installed perform the same command for 1.0.1 as well:

sudo install_name_tool -add_rpath /usr/local/opt/openssl/lib /usr/local/share/dotnet/shared/Microsoft.NETCore.App/1.0.1/System.Security.Cryptography.Native.dylib

In effect, rather than telling the operating system to always use the homebrew version of SSL and potentially causing something to break, we're telling dotnet how to find the correct library.

Also importantly, it looks like Microsoft are aware of the issue and and have both a) a somewhat immediate plan to mitigate as well as b) a long-term solution (probaby bundling OpenSSL with dotnet).

Another thing to note: /usr/local/opt/openssl/lib is where the brew is linked by default:

13:22 $ ls -l /usr/local/opt/openssl
lrwxr-xr-x  1 ben  admin  26 May 15 14:22 /usr/local/opt/openssl -> ../Cellar/openssl/1.0.2h_1

If for whatever reason you install the brew and link it in a different location, then that path is the one you should use as an rpath.

Once you've update the rpath of the System.Security.Cryptography.Native.dylib libray, you'll need to restart your interactive session (i.e., close your console and start another one).

7
  • Where am I supposed to add that line? I'm trying to get this to work in CI. I'm getting a /usr/local/share/dotnet/shared/Microsoft.NETCore.App/1.0.0/System.Security.Cryptography.Native.dylib (No such file or directory).
    – mrahhal
    Aug 2, 2016 at 12:20
  • @mrahhal that's the installation path of the dotnet tooling. Its possible that you either don't have it installed or you installed or to another location. If its installed and on your part, you could use which dotnet to find it. Aug 2, 2016 at 12:23
  • Oh, just realized I'm adding this line before installing dotnet. Will retry and come back.
    – mrahhal
    Aug 2, 2016 at 12:24
  • 3
    Worked for me, in my case the sdk was installed to a different directory so I had to change the path.
    – mrahhal
    Aug 2, 2016 at 13:16
  • 4
    With dotnet 1.1.0 I had to do: sudo install_name_tool -add_rpath /usr/local/opt/openssl/lib /usr/local/share/dotnet/shared/Microsoft.NETCore.App/1.1.0/System.Security.Cryptography.Native.OpenSsl.dylib
    – Bouke
    Jan 24, 2017 at 9:58
52

None of these solutions worked for me on OS X El Capitan 10.11.6. Probably because OS X has a native version of openssl that it believes is superior, and as such, does not like tampering.

So, I took the high road and started fresh...


Manually install and symlink

cd /usr/local/src  
  • If you're getting "No such file or directory", make it:

    cd /usr/local && mkdir src && cd src

Download openssl:

curl --remote-name https://www.openssl.org/source/openssl-1.0.2h.tar.gz

Extract and cd in:

tar -xzvf openssl-1.0.2h.tar.gz
cd openssl-1.0.2h

Compile and install:

./configure darwin64-x86_64-cc --prefix=/usr/local/openssl-1.0.2h shared
make depend
make
make install

Now symlink OS X's openssl to your new and updated openssl:

ln -s /usr/local/openssl-1.0.2h/bin/openssl /usr/local/bin/openssl

Close terminal, open a new session, and verify OS X is using your new openssl:

openssl version -a
8
  • If you're trying to install .NET core on OS X you should wrap it in Docker.
    – mcgwier
    Aug 2, 2016 at 1:06
  • 6
    After doing all this: OpenSSL 0.9.8zh 14 Jan 2016 built on: May 15 2016 platform: darwin64-x86_64-llvm Sep 9, 2016 at 15:13
  • 5
    Creating a symlink in the following way worked for me: ln -s /usr/local/openssl-1.0.2h/bin/openssl /usr/local/bin/openssl. After restarting your Terminal session, type which openssl to make sure you are using the updated 1.0.2 version (/usr/local/bin/openssl) instead of the built-in one (/usr/bin/openssl).
    – Olivier
    Dec 19, 2016 at 12:47
  • 1
    I followed these instructions but when I type in which openssl, I get (/opt/local/bin/openssl). How do I get it to be /usr/local/bin/openssl?
    – Chris
    Dec 22, 2016 at 20:58
  • 2
    I followed these instructions (thank you so much for the step-by-step), and it still said 0.9.8. Thank you to Olivier for the alternate linking method that worked.
    – Onikoroshi
    Jan 12, 2017 at 3:55
51

Just execute brew info openssland read the information where it says:

If you need to have this software first in your PATH run: echo 'export PATH="/usr/local/opt/openssl/bin:$PATH"' >> ~/.bash_profile

4
  • 3
    brew info openssl gave the same helpful information for me. Running the suggested command above and then running source ~/.bash_profile or opening a new terminal solved it for me.
    – PanPipes
    Feb 23, 2017 at 10:19
  • 2
    FINALLY. This also worked for me. The other answers above did not!
    – user124384
    Apr 23, 2017 at 1:01
  • 3
    or echo 'export PATH="/usr/local/opt/openssl/bin:$PATH"' >> ~/.zshrc
    – B.Ma
    Sep 30, 2017 at 9:10
  • This did not work. I'm getting the same message again.
    – not2savvy
    Apr 20 at 15:04
22

If migrating your mac breaks homebrew:

I migrated my mac, and it unlinked all my homebrew installs - including OpenSSL. This broke gem install, which is how I first noticed the problem and started trying to repair this.

After a million solutions (when migrating to OSX Sierra - 10.12.5), the solution ended up being comically simple:

brew reinstall ruby
brew reinstall openssl

Edit much later: as Gal Bracha noted in the comments, you ?might? need to delete /usr/local/opt/openssl before doing the reinstalls, just to be safe. I didn't need to at the time, but if you're still having trouble, give that a try.

4
  • And a year later, this happened to me migrating my Mac, and your fix worked for me as well. Thanks so much; I was getting to the point of considering wiping my new Mac and doing a fresh install and setting everything up again manually.
    – David
    Jun 28, 2018 at 12:25
  • @David glad I could keep you from going over the brink! I almost did the same.
    – tobybot
    Jun 28, 2018 at 14:54
  • 1
    You might also need to delete this folder before doing the above. rm -rf /usr/local/opt/openssl
    – Gal Bracha
    Sep 19, 2018 at 10:33
  • 1
    I would kiss you if you were next to me. This is what worked for me after 3 hrs of struggle.
    – Tarun
    Aug 17, 2021 at 15:11
10

The solution above from edwardthesecond worked for me too on Sierra

 brew install openssl
 cd /usr/local/include 
 ln -s ../opt/openssl/include/openssl 
 ./configure && make

Other steps I did before were:

  • installing openssl via brew

    brew install openssl
    
  • adding openssl to the path as suggested by homebrew

    brew info openssl
    echo 'export PATH="/usr/local/opt/openssl/bin:$PATH"' >> ~/.bash_profile
    
1
  • 1
    Worked nice for me, just skipped la part './configure && make' Jun 8, 2018 at 6:21
9

After trying everything I could find and nothing worked, I just tried this:

touch ~/.bash_profile; open ~/.bash_profile

Inside the file added this line.

export PATH="$PATH:/usr/local/Cellar/openssl/1.0.2j/bin/openssl"

now it works :)

Jorns-iMac:~ jorn$ openssl version -a
OpenSSL 1.0.2j  26 Sep 2016
built on: reproducible build, date unspecified
//blah blah
OPENSSLDIR: "/usr/local/etc/openssl"

Jorns-iMac:~ jorn$ which openssl
/usr/local/opt/openssl/bin/openssl
5
  • 1
    This is a really simple solution and I was pretty hopeful that it would work for me but no luck here. Even after updating my PATH and restarting my shell session which openssl still points to /usr/bin/openssl Nov 19, 2016 at 23:48
  • In order to get this working I had to edit my .bash_profile as well. But the only thing that worked was telling it to look in /usr/local/bin instead of /usr/bin. I did this by adding export PATH=/usr/local/bin:$PATH Dec 21, 2016 at 16:40
  • 4
    For this to work, you need to add /usr/local/opt/openssl/bin, without the /openssl on the end, to the front of the PATH, not the end: PATH=/usr/local/opt/openssl/bin:$PATH Using /usr/local/opt/openssl instead of /usr/local/Cellar/openssl/$version means you'll automatically keep the most up-to-date version in your $PATH without having to change it every time you upgrade.
    – Mark Reed
    Oct 16, 2017 at 14:36
  • 1
    After hours of dumbness this did the trick for me along with @MarkReed's additional notes
    – Naomi See
    Feb 25, 2018 at 4:57
  • 1
    I was able to use this and get it working for me. Thank you. I have 1.0.2q version of openssl. Feb 15, 2019 at 22:46
8

I have a similar case. I need to install openssl via brew and then use pip to install mitmproxy. I get the same complaint from brew link --force. Following is the solution I reached: (without force link by brew)

LDFLAGS=-L/usr/local/opt/openssl/lib 
CPPFLAGS=-I/usr/local/opt/openssl/include
PKG_CONFIG_PATH=/usr/local/opt/openssl/lib/pkgconfig 
pip install mitmproxy

This does not address the question straightforwardly. I leave the one-liner in case anyone uses pip and requires the openssl lib.

Note: the /usr/local/opt/openssl/lib paths are obtained by brew info openssl

2
  • Found this one useful for installing pysqlcipher
    – drtf
    Dec 5, 2016 at 12:05
  • Useful for installing cryptography. I was missing the PKG_CONFIG_PATH variable
    – Sagar
    Dec 15, 2016 at 22:38
8

This worked for me:

 brew install openssl
 cd /usr/local/include 
 ln -s ../opt/openssl/include/openssl .
1
  • This worked for me, trying to compile PHP 7.2.1 with phpbrew on Mac OS High Sierra - Thanks! Jan 10, 2018 at 1:10
4

By default, homebrew gave me OpenSSL version 1.1 and I was looking for version 1.0 instead. This worked for me.

To install version 1.0:

brew install https://github.com/tebelorg/Tump/releases/download/v1.0.0/openssl.rb

Then I tried to symlink my way through it but it gave me the following error:

ln -s /usr/local/Cellar/openssl/1.0.2t/include/openssl /usr/bin/openssl
ln: /usr/bin/openssl: Operation not permitted

Finally linked openssl to point to 1.0 version using brew switch command:

brew switch openssl 1.0.2t
Cleaning /usr/local/Cellar/openssl/1.0.2t
Opt link created for /usr/local/Cellar/openssl/1.0.2t
1
  • 2
    Calling Non-checksummed download of openssl formula file from an arbitrary URL is disabled!
    – AlxVallejo
    Oct 8, 2020 at 19:45
3

I had the same problem while trying to install newer version of ruby 2.6.5 https://github.com/kelaberetiv/TagUI/issues/86 helps me to solve the problem. This if for macOS catalina Version 10.15.1

Basically, I did update and upgrade homebrew and install openssl and install ruby.

brew update && brew upgrade
brew install openssl

Then create these 2 symlinks

ln -s /usr/local/opt/openssl/lib/libcrypto.1.0.0.dylib /usr/local/lib/
ln -s /usr/local/opt/openssl/lib/libssl.1.0.0.dylib /usr/local/lib/

then installed ruby 2.6.5

1

Note: this no longer works due to https://github.com/Homebrew/brew/pull/612

I had the same problem today. I uninstalled (unbrewed??) openssl 1.0.2 and installed 1.0.1 also with homebrew. Dotnet new/restore/run then worked fine.

Install openssl 101:
brew install homebrew/versions/openssl101
Linking:
brew link --force homebrew/versions/openssl101

6
  • 2
    This did it! Seems that 1.0.2 didn't want to link. Next question is why does .netcore suggest something that is not recommended in the community.
    – daviddeath
    Jul 30, 2016 at 16:42
  • 1.0.2 worked for me on another mac a few days ago, so maybe there is a recent brew or openssl change. Anyway, for dot net core, we are good :)
    – Gustav
    Jul 30, 2016 at 18:55
  • 1
    The github link posted by @bartonjs shows that brew was updated just a few days ago. Looking at the commit, the change is ` if HOMEBREW_PREFIX.to_s == "/usr/local" && keg.name == "openssl"` so I'm guessing that the 1.0.1 version uses a different HOMEBREW_PREFIX.
    – daviddeath
    Jul 30, 2016 at 23:03
  • 11
    didn't work for me, still gives error Refusing to link: openssl101 Linking keg-only openssl101 means you may end up linking against the insecure, deprecated system OpenSSL while using the headers from Homebrew's openssl101. Instead, pass the full include/library paths to your compiler e.g.: -I/usr/local/opt/openssl101/include -L/usr/local/opt/openssl101/lib
    – dark_ruby
    Jul 31, 2016 at 20:10
  • 6
    This answer is no longer correct given the change made by homebrew devs at github.com/Homebrew/brew/pull/612
    – Joshka
    Aug 1, 2016 at 2:36
1

for me this is what worked...

I edited the ./bash_profile and added below command

export PATH="/usr/local/opt/openssl/bin:$PATH"

1
export https_proxy=http://127.0.0.1:1087 http_proxy=http://127.0.0.1:1087 all_proxy=socks5://127.0.0.1:1080

works for me

and I think it can solve all the problems like Failed to connect to raw.githubusercontent.com port 443: Connection refused

1

The solution might be updating some tools.

Here's my scenario from 2020 with Ruby and Python:

I needed to install Python 3 on Mac and things escalated. In the end, updating homebrew, node and python lead to the problem with openssl. I did not have openssl 1.0 anymore, so I couldn't "brew switch" to it.
So what was still trying to use that old 1.0 version?

It tuned out it was Ruby 2.5.5.
So I just installed Ruby 2.5.8 and removed the old one.

Other things you can try if this is not enough: Use rbenv and pyenv. Clean up gems and formulas. Update homebrew, node, yarn. Upgrade bundler. Make sure your .bash_profile (or equivalent) is set up according to each tool's instructions. Reopen the terminal.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.