Building Python 3.7.1 - SSL module failed

Question

Building Python 3.7 from source runs into following error:

Failed to build these modules:
_hashlib              _ssl                                     

Could not build the ssl module!
Python requires an OpenSSL 1.0.2 or 1.1 compatible libssl with X509_VERIFY_PARAM_set1_host().
LibreSSL 2.6.4 and earlier do not provide the necessary APIs, https://github.com/libressl-portable/portable/issues/381

I tried so many workarounds from other stackoverflow-questions, but it doesnt work. I build newest OpenSSL and LibreSSL from source. OpenSSL path is: "/usr/local/ssl" with version OpenSSL 1.0.2p.

./configure --with-openssl=/usr/local/ssl/
(./configure CPPFLAGS="-I/usr/local/ssl/include" LDFLAGS="-L/usr/local/ssl/lib")
make 
make altinstall

My system: Ubuntu 12.04.5 LTS

Any ideas?

Answer 1

I solved it after 3 days only because of this blog. with python 3.7.4 openssl 1.1.0 centOS 6.

here is the summary :

First, some prerequisites:

sudo apt-get install build-essential checkinstall libreadline-gplv2-dev libncursesw5-dev libsqlite3-dev tk-dev libgdbm-dev libc6-dev libbz2-dev

use yum instead of apt-get if using centos linux.

Install ssl 1.0.2 or higher.

    cd /usr/src
    curl https://www.openssl.org/source/openssl-1.0.2o.tar.gz | tar xz
    cd openssl-1.0.2o
    ./config shared --prefix=/usr/local/
    sudo make
    sudo make install

We will need to pass /usr/src/openssl-1.0.2o into the Python configure script.

mkdir lib
cp ./*.{so,so.1.0.0,a,pc} ./lib

Now proceed with installing Python:

    cd /usr/src
    sudo wget https://www.python.org/ftp/python/3.7.0/Python-3.7.0.tgz
    sudo tar xzf Python-3.7.0.tgz
    cd Python-3.7.0
    ./configure --with-openssl=/usr/src/openssl-1.0.2o --enable-optimizations
    sudo make
    sudo make altinstall

To test it out, run python3.7 and input:

import ssl
ssl.OPENSSL_VERSION

Hope it helps!

Answer 2

Compiling openssl

Download your openssl tarball, unzip, and then ensure that the install directory is named openssl.

I placed mine in /usr/local/openssl, so I'll use that in my example.

1. sudo mv openssl-1.0.2u /usr/local/openssl && cd /usr/local/openssl

2. sudo make distclean

3. sudo ./config -fPIC -shared

4. sudo make && sudo install

Now, add the openssl shared library to your PATH.

5. vim ~/.profile Go export LD_LIBRARY_PATH="/usr/local/openssl/lib:$LD_LIBRARY_PATH" :wq

Compiling Python3

The key here is understanding that the path you define with --with-openssl= is where Python looks for /openssl/lib. You need to give Python the parent directory of the openssl directory.

That means that if you set --with-openssl=/usr/local/openssl your make install will fail even though the make logs show that openssl is fine!

--enable-optimizations is irrelevant but recommended - longer make for 10% faster Python code is a good tradeoff.

--prefix= is merely where I'd like python3 to install, if you didn't know.

1. sudo make distclean

Edit your python setup file

2. vim /{yourpythonsource}/Modules/Setup

Uncomment out the following lines and ensure that your SSL variable points to your openssl directory. In mine, it was looking for the directory 'ssl' instead of 'openssl.'

<pre><code># Socket module helper for SSL support; you must comment out the other </code> 

<pre><code># socket line above, and possibly edit the SSL variable: </code>

<code>SSL=/usr/local/openssl
_ssl _ssl.c \
-DUSE_SSL -I$(SSL)/include -I$(SSL)/include/openssl \
-L$(SSL)/lib -lssl -lcrypto</code>

3. sudo ./configure --with-openssl=/usr/local --prefix=/opt/python-3.7.1

4. sudo make && sudo make install

Answer 3

While this might not be the best answer, I will share how I solved this problem.

1. First of all, in my case, OpenSSL did not build correctly, as make test did return errors (and consequently Python gave this error). This was solved by installing a newer version of Perl and then installing OpenSSL again (configure, make, etc).

2. Use this command before using ./configure

   export LD_LIBRARY_PATH=/path/to/openssl/lib:$LD_LIBRARY_PATH

3. At the configure command, include the library:

   LDFLAGS="-L/path/to/openssl/lib" ./configure (all your preferred options) --with-openssl=/path/to/openssl

   as apparently the option for configure does not convey the message to the C compiler which needs it.

Am not sure whether option 2 and 3 are needed simultaneously, but I did so and it worked.