Document
OpenSSL 1.0.1e Configuration
Author
Mark <mark@ibiblio.org>



What is it

OpenSSL 1.0.1e is a toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library.

The installation of openssl is controlled by the package subsystem, thus it is quite easy to install and upgrade when new versions become available.

The main web site for the software is https://www.openssl.org/.



Installation Of The Software

Fetch the package and install it with:
    # pkgadd -d openssl.1.0.1e.SPARC.64bit.Solaris.10.pkg openssl



Problems With Previous Versions

The previous version of OpenSSL is the 0.9.8 release. Quite likely the vast majority of your software (and most of the packages in this archive) has been compiled against this version of OpenSSL. If you were to simply install the latest OpenSSL 1.0.1e (and cleaned up the older 0.9.8 software) then all of those programs would fail with a missing libcrypto.so.0.9.8 etc. To help this situation the OpenSSL packages could provide legacy softlinks from older libraries to the newer ones:

host:/root root# ls -l /usr/local/lib/libcrypto.so.*
lrwxrwxrwx   1 root     root          18 Mar  5 16:30 /usr/local/lib/libcrypto.so.0.9.7 -> libcrypto.so.1.0.0
lrwxrwxrwx   1 root     root          18 Mar  5 16:30 /usr/local/lib/libcrypto.so.0.9.8 -> libcrypto.so.1.0.0
-r-xr-xr-x   1 root     root     2785108 Mar  5 16:30 /usr/local/lib/libcrypto.so.1.0.0

This linking of old versions to newer ones worked for the previous 0.9.7 version of OpenSSL but there is a problem because the newer 1.0.1e library will cause linking problems with programs that need the older software:

host:/root root# ssh remotehost
OpenSSL version mismatch. Built against 90817f, you have 1000105f
lap:/root root# ldd /usr/local/bin/ssh
       libresolv.so.2 =>        /lib/libresolv.so.2
       libcrypto.so.0.9.8 =>    /usr/local/lib/libcrypto.so.0.9.8
       libz.so =>       /usr/local/lib/libz.so
       libsocket.so.1 =>        /lib/libsocket.so.1

What I've elected to do is simply ship two versions of OpenSSL, the new 1.0.1e library and also the legacy 0.9.8y library as well. This means when you install this OpenSSL 1.0.1e Solaris package onto a machine you will get two copies of the libraries. This seems to be the simplest fix.

host:/usr/local/lib root# ls -al libssl* libcrypto*
-rw-r--r--   1 root     root     4299640 Mar  5 17:55 libcrypto.a
lrwxrwxrwx   1 root     root          18 Mar  5 17:55 libcrypto.so -> libcrypto.so.1.0.0
lrwxrwxrwx   1 root     root          18 Mar  5 17:55 libcrypto.so.0.9.7 -> libcrypto.so.0.9.8
-rwxr-xr-x   1 root     root     2567688 Mar  5 18:06 libcrypto.so.0.9.8
-r-xr-xr-x   1 root     root     3032928 Mar  5 17:55 libcrypto.so.1.0.0
-rw-r--r--   1 root     root      707964 Mar  5 17:55 libssl.a
lrwxrwxrwx   1 root     root          15 Mar  5 17:55 libssl.so -> libssl.so.1.0.0
lrwxrwxrwx   1 root     root          15 Mar  5 17:55 libssl.so.0.9.7 -> libssl.so.0.9.8
-rwxr-xr-x   1 root     root      471696 Mar  5 18:06 libssl.so.0.9.8
-r-xr-xr-x   1 root     root      567796 Mar  5 17:55 libssl.so.1.0.0

I'll update this file when and if this causes problems with compiling and linking to OpenSSL, I don't expect there to be problems however. You simply need to be aware that OpenSSL has changed and the new version isn't binary backwards compatible. The steps detailed here try to mitigate any problems this can cause.



Web Site
The main web site for OpenSSL is https://www.openssl.org

Solaris Issues
Each OpenSSL package requires installation on the Solaris release it was built on. Only install the correct version for your system.

Source Code
You can download the source code from https://www.openssl.org/source/

Special Issues
See the main packages README for installation information.