Re: Custom OpenSSL

On 8/6/24 7:02 PM, Tomasz Kurzawa wrote:
> Hi All,
> 
> I am currently working on building Cryptsetup with the --enable-fips
> option and integrating it with my custom OpenSSL build, rather than
> the default OpenSSL provided by the operating system. Despite my
> efforts, the debug messages indicate that the system’s OpenSSL version
> is still being used.

Cryptsetup does not do any magic here, it just use what it detects.

So, for compilation, change your pkgconfig to point to your devel version
(usually links in libcrypto.pc, not in openssl.pc that references it!).

After installation, is is only about your ldconfig path.

It is not so easy as link to one library, OpenSSL3 uses providers and these
need to be loaded from a specific location (see libcrypto.pc).

If it is for older OpenSSL2, then situation can slightly differ, but
the logic is the same.

> 
> Here is the command I used for the build (custom OpenSSL is installed
> in /usr/local):
> 
> LIBCRYPTO_LIBS="/usr/local/lib64" LDFLAGS="-Wl,-rpath,/usr/local/lib64
> -L/usr/local/lib64" CPPFLAGS="-I/usr/local/include" LIBS="-lcrypto
> -lssl" ./configure --enable-fips
> make

Do not use it this way, keep autoconf to detect LIBCRYPTO_LIBS
(set by pkgconfig).

Milan