Compiling Python 2.7.12 with non-system Openssl on Centos 5

Question

I'm currently trying to get Python 2.7.12 to compile with Openssl 1.0.2h on a Centos 5 host.

The reason for this is that I need Paramiko 2 to run on this host but that doesn't support the system provided OpenSSL version which is 0.9.8e-fips-rhel5 01 Jul 2008.

I've found some great hints and tips on here but it just doesn't seem to work. I'm now posting this in hope that someone will spot what I've done wrong/is missing.

For the OpenSSL setup I've done the following:

OPENSSL_ROOT="$HOME/.build/openssl-1.0.1e"
cd /tmp
curl http://www.openssl.org/source/openssl-1.0.2h.tar.gz | tar zxvf -
cd openssl-1.0.2.h
mkdir -p "$OPENSSL_ROOT"
./config no-hw --prefix="$OPENSSL_ROOT" --openssldir=...
make install

Then since I don't want to replace the system installed Python with 2.7.12 I've done the following:

First I added /usr/local/lib to /etc/ld.so.conf and ran ldconfig.

After that I've run:

cd /tmp
wget http://python.org/ftp/python/2.7.12/Python-2.7.12.tar.xz
tar xf Python-2.7.12.tar.xz
cd Python-2.7.12
./configure CPPFLAGS="-I$OPENSSL_ROOT/include"  LDFLAGS="-L$OPENSSL_ROOT/lib"  --prefix=/usr/local --enable-unicode=ucs4 --enable-shared
make && make altinstall

This is when I thought I'd have it compiled against the new version of OpenSSL but no, as you can see from the output here:

[root@an-host openssl-1.0.2h]# python2.7 -c "import ssl; print ssl.OPENSSL_VERSION"
OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008

And I'm sure that I'm running the newly compiled version since that is echoed here:

[root@an-host openssl-1.0.2h]# python2.7
Python 2.7.12 (default, Aug  1 2016, 11:46:42) 
[GCC 4.1.2 20080704 (Red Hat 4.1.2-55)] on linux2
Type "help", "copyright", "credits" or "license" for more information.

I have even gone as far as removing openssl-devel with Yum but it still doesn't seem to care/compile against 1.0.2h.

This is driving me slightly mad at the moment so any input/feedback/help is greatly appreciated.

I'm not really sure that I'm following you here. The question was how to compile Python 2.7.12 with a 'non-system-standard' OpenSSL build that has been compiled to a 'non-default' directory. Are you implying that it won't compile with a 1.x but would with a 0.98 version? Or are you talking about what you think that Paramiko 2 needs? — Swedish Mike, Aug 01 '16 at 11:52
When I recently built it on Centos 7 I'm pretty sure it needed 0.98x — Keef Baker, Aug 01 '16 at 12:06
What, exactly, is the problem? Where is the error message or problem? — jww, Aug 01 '16 at 12:56
The problem is that although I thought I had told Python 2.7.12 to compile against the OpenSSL 1.0.2h libraries it still gives this output: `[root@an-host openssl-1.0.2h]# python2.7 -c "import ssl; print ssl.OPENSSL_VERSION" OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008` Paramiko 2 won't run on that version of OpenSSL so I need Python to compile against the newer version. And no - Centos5 don't give you newer versions of Openssl as pre-compiled RPM's, nor does it provide newer version of Paramiko. I need Paramiko2 and I cannot change the host either due to limitations in the environment. — Swedish Mike, Aug 01 '16 at 13:23

score 8 · Accepted Answer · answered Aug 01 '16 at 13:58

I think I tried to copy too cute solutions and mix and match - tidied up and simplified a bit and got it to work in the end.

This is what I did this time:

Download and install OpenSSL

cd /tmp 
curl http://www.openssl.org/source/openssl-1.0.2h.tar.gz | tar zxvf - 
cd openssl-1.0.2.h 
./config shared --prefix=/usr/local/ 
make && make install

Set up some environment variables

export LDFLAGS="-L/usr/local/lib/"
export LD_LIBRARY_PATH="/usr/local/lib/"
export CPPFLAGS="-I/usr/local/include -I/usr/local/include/openssl"

Download and install Python 2.7.12

wget http://python.org/ftp/python/2.7.12/Python-2.7.12.tar.xz
tar xf Python-2.7.12.tar.xz
cd Python-2.7.12
./configure --prefix=/usr/local/ --enable-unicode=ucs4 --enable-shared
make && make altinstall

And now it works as expected, displaying the newer OpenSSL version.

[root@an-host Python-2.7.12]# python2.7
Python 2.7.12 (default, Aug  1 2016, 14:48:09) 
[GCC 4.1.2 20080704 (Red Hat 4.1.2-55)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import ssl
>>> print ssl.OPENSSL_VERSION
OpenSSL 1.0.2h  3 May 2016

However, it still didn't work as expected. :( Running the program I got the following error from Paramiko:

RuntimeError: You are linking against OpenSSL 0.9.8, which is no longer support by the OpenSSL project. You need to upgrade to a newer version of OpenSSL.

The solution I found was to uninstall and reinstall the Cryptography bits and pieces by running.

pip2.7 uninstall cryptography
pip2.7 install cryptography

After all that - it now works.

Compiling Python 2.7.12 with non-system Openssl on Centos 5

1 Answers1