How to link python 2.7 with latest openssl version in MAC OS?

Question

When I run:

$ openssl version -a

I get 1.0.2k as version:

OpenSSL 1.0.2k  26 Jan 2017
built on: reproducible build, date unspecified
platform: darwin64-x86_64-cc
options:  bn(64,64) rc4(ptr,int) des(idx,cisc,16,int) idea(int) blowfish(idx) 
compiler: cc -I. -I.. -I../include  -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -arch x86_64 -O3 -DL_ENDIAN -Wall -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM
OPENSSLDIR: "/usr/local/php5/ssl"

But when I check the version with python:

$ python -c 'import ssl; print(ssl.OPENSSL_VERSION)'

I get: OpenSSL 0.9.8zg 14 July 2015

How can I link the latest openssl version? My pip version is ;

pip 10.0.1 from /Library/Python/2.7/site-packages/pip (python 2.7)

When I try to install some modules using PIP I get [SSL: TLSV1_ALERT_PROTOCOL_VERSION] tlsv1 alert protocol version (_ssl.c:590) error. So trying to upgrade my ssl version in python

And How to make my system Openssl version is same as virtualenv version?

Answer 1

You really do not want to muck with the system Python. It's built as its built to work with your OS when it needs to do so.

If you need a more up to date OpenSSL build with Python, use something like brew or macports or the python.org packages to install more recent builds of Python 2 or 3 and use those.

(For reference, my brew Python 3.6 Python was built against OpenSSL 1.0.2o, as an example)

Answer 2

How can I link the latest openssl version?

This is only possible when compiling Python from source; the location of OpenSSL headers and libraries to compile with/link against is set via CPPFLAGS/LDFLAGS/LD_LIBRARY_PATH environment variables, as described here. You can't "relink" the code once it's compiled, though.

Another issue is that you won't be able to alter the system Python in MacOS without some dangerous system modification. Python preinstalled by MacOS is located under /System/Library/Frameworks/Python.framework, and you can't modify or delete anything under /System without turning off the System Integrity Protection (I would strongly advise not to do that anyway).

The suggested solution is thus to leave the system Python as-is and install another copy for own use. On MacOS, you usually have two choices: either use Homebrew that offers the latest Python 2 and 3 versions, or use the official .pkg installers from https://www.python.org/downloads/. Both were built against OpenSSL of a recent version. What to choose depends on your use case; personally, I don't use the brewed Python because it doesn't offer multiple versions of Python 3 package (for example, I need 3.5/3.6/3.7 to be installed simultaneously to run the tests against). The major downside with the .pkg installers is that the installed Python is installed outside of any package manager and won't be updated automatically, so you are responsible of updating it yourself. Worst case, this means downloading a new installer and reinstalling even on a minor version bump.

Once installed, adjust the PATH variable for your user so the newly installed Python precedes the system one. For brewed Python, open ~/.bash_profile and append

BREW_PREFIX=$(brew --prefix)
PATH="$BREW_PREFIX/bin:$BREW_PREFIX/sbin:$PATH"
export PATH

For Python installed via the official .pkg installer: the profile should be modified automatically in the installation; nevertheless, it doesn't hurt to double-check. Open ~/.bash_profile and check whether the lines similar to

# Setting PATH for Python 3.6
# The original version is saved in .bash_profile.pysave
PATH="/Library/Frameworks/Python.framework/Versions/3.6/bin:${PATH}"
export PATH

are present; if not, append them for your installed Python version.