7

We wanted to upgrade OpenSSL in centos 7 but it didn't happen, the reason may be this. Upgrading CentOS 7 to OpenSSL 1.1.1 by yum install openssl11

I've came to know openssl11 is for "spot" usage. Can we link python / pyOpenssl with openssl11. Please give me the process, if possible

1
  • 1
    It's hard to answer properly without writing a book, because you unfortunately didn't clarify whether you care about Python and/or pyOpenSSL. And dependent on the previous an answer whether it's about Python 2.7 or 3.6 and if you are targetting the ancient pyOpenSSL 0.13.1 (or a more recent version) would be helpful, too.
    – rsc
    Oct 9, 2021 at 23:33

4 Answers 4

9

I just ran into this problem today while trying to build Python 3.10 on CentOS 7, and found this thread while trying to figure it out. In my case I'm just trying to get all of Python to build, including the SSL module which it attempts to build by default. What follows may or may not be adaptable to building pyOpenSSL by itself.

I found that the configure script appears to be designed to work with OpenSSL files that are installed in the normal locations in /usr/lib64 and /usr/include, or alternatively in one single location that you can specify on the command line with the --with-openssl parameter, under which you can find the include files and libraries directly. The 'openssl11-devel' package in RHEL/CentOS 7 satisfies neither of these expectations, and as far as I can tell this can't be dealt with on the configure command line.

I found the easiest way to work around it was to just change the library name the script is using with its pkg-config queries, so it can get the correct details from the .pc file which fortunately is in the standard location under /usr/lib64/pkgconfig but with a different name.

The approach I used happens to work with an install of Python3.10.0 on CentOS 7, though admittedly it's brittle and may not continue to work with other versions. From within the source directory:

sed -i 's/PKG_CONFIG openssl /PKG_CONFIG openssl11 /g' configure

Having done the above, I run ./configure. I see in the output:

checking whether compiling and linking against OpenSSL works... yes

...rather than the 'no' I was getting before.

Probably unrelated -- I am unable to get the compile to work with --enable-optimizations on CentOS 7, for whatever reason. I get the 'Could not import runpy module' error, so I configure without it.

7

I had to install Python 3.10.6 in a CentOS 7 server and I found this mail thread that helped me create the OpenSSL 1.1.1 "spot" installation and use it in the Python installation.

I decided to install all in /opt but you can choose a different location.

# Install OpenSSL 1.1.1
cd /opt
curl https://ftp.openssl.org/source/old/1.1.1/openssl-1.1.1j.tar.gz --output openssl.tar.gz
tar xzf openssl.tar.gz
rm openssl.tar.gz
cd openssl-1.1.1j/
./config --prefix=/opt/openssl && make && make install

# Install Python 3.10.6
cd /opt
wget https://www.python.org/ftp/python/3.10.6/Python-3.10.6.tgz
tar xzf Python-3.10.6.tgz
cd Python-3.10.6
./configure --with-openssl=/opt/openssl
make
make altinstall

Test installation

python3.10 --version
# Output: Python 3.10.6
1
  • I've had to specify --with-openssl-rpath=auto option when using prefix $HOME/.local for both OpenSSL and Python.
    – Winand
    Jul 13 at 8:29
4

So this is an old-ish question but it's still not obvious how to do this in 2023 so I'll post my answer.

I also needed to install Python3.11.2 on RHEL 7, and of course Python needs OpenSSL 1.1.1+.

However I needed to keep the older existing OpenSSL installation in-tact - mainly because I rely on other OS packages that break with the new version (for example, authconfig).

The approach below worked for me.

Install packages:

yum install openssl11 openssl11-devel

(I had tried downloading and building OpenSSL from source which worked for Python but broke other OS packages I use)

Verify installed OpenSSL versions:

which openssl      # prints /usr/bin/openssl
which openssl11    # prints /usr/bin/openssl11
openssl version    # prints OpenSSL 1.0.2k-fips  26 Jan 2017
openssl11 version  # prints OpenSSL 1.1.1k  FIPS 25 Mar 2021

The location of the openssl11 binary and libraries for building Python are then here:

which openssl          # prints /usr/bin/openssl11
ls -l /lib64/openssl11 # prints symlinks to openssl 1.1.1k files in /lib64

Then I built Python 3.11.2 from source. Note that gcc version was 4.8.5 on my RHEL7 and this may cause some problems per comments below. I was fine with not enabling optimisations.

# ... first download and untar ...#

...

# Configure
# --enable-optimizations caused problems for me. YMMV
LDFLAGS="${LDFLAGS} -Wl,-rpath=/lib64/openssl11/" ./configure --with-openssl=/bin/openssl11

# Single-core build. Multithreading (-j option) caused problems. 
make

# Install
make altinstall
ln -sf /usr/local/bin/python3.11 /usr/bin/python3
0

Can't comment yet, but I wanted to expand on Circle's response below. Using Fedora 28 and installing Python 3.11.5

I ran the following setup:

# Install OpenSSL 1.1.1
cd /opt
curl https://ftp.openssl.org/source/old/1.1.1/openssl-1.1.1j.tar.gz --output openssl.tar.gz
tar xzf openssl.tar.gz
rm openssl.tar.gz
cd openssl-1.1.1j/
./config --prefix=/opt/openssl && make && make install

# Install Python 3.11.5
cd /opt
wget https://www.python.org/ftp/python/3.11.5/Python-3.11.5.tgz
tar xzf Python-3.11.5.tgz
cd Python-3.11.5
./configure --with-openssl=/opt/openssl --with-openssl-rpath=auto
make
make altinstall

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.