Forum OpenACS Development: nsssl with local copy of ssl libraries

Posted by Dave Bauer on
I am installed naviserver on a Centos install that has an older openssl.

It has openssl compiled locally at /usr/local/ssl as well.

I modified the makefile to compile nsssl with the /usr/local/ssl version but its still linked to the /lib64/ so it doesn't actually work.

Here is my modified Makefile.

NAVISERVER = /usr/local/ns

# Module name
MODLIBS = -L/usr/local/ssl/lib -Wl,-rpath,/usr/local/ssl/lib
# Objects to build.
OBJS = nsssl.o
CFLAGS = -I/usr/local/ssl/include
MODLIBS += -lssl -lcrypto

include $(NAVISERVER)/include/Makefile.module

openssl dhparam -C -2 -noout 512 >> dhparams.h
openssl dhparam -C -2 -noout 1024 >> dhparams.h

nsssl.o: dhparams.h

Posted by Dave Bauer on
It appears to be a problem with 32 and 64 bit libraries installed on the same machine.
Posted by Gustaf Neumann on
I read between the lines, that the problem is solved. The detailed behavior what happens when someone is trying to link 64bit apps with 32bit libraries and vice versa depends on the OS and is typically not obvious.

From the experience with HeartBleed, i would NOT recommend to link against a local version of OpenSSL, but to use a distribution maintained version. The update frequency of OpenSSL is quite high. Keeping a locally maintained copy of OpenSSL up-to-date is constant work, keeping it not up-to-date is constant danger.