How to use latest openssl library with pyOpenSSL?

Question

I am currently using pyOpenssl, and it uses openssl 1.0.1f which is installed by system. now I install openssl 1.0.1j from source, and set new version library path into LD_LIBRARY_PATH, at this time, when I running my py file, it will produce error:

File "sslcert.py", line 5, in <module>
from OpenSSL import SSL, _util, crypto
...

File "/usr/local/lib/python2.7/dist-packages/cffi-0.8.6-py2.7-linux-x86_64.egg/cffi/vengine_cpy.py", line 149, in load_library
    raise ffiplatform.VerificationError(error)
cffi.ffiplatform.VerificationError:  
importing '/usr/local/lib/python2.7/dist-packages/cryptography-0.6.1-py2.7-linux-x86_64.egg/cryptography/_Cryptography_cffi_36a40ff0x2bad1bae.so':    
/usr/local/lib/python2.7/dist-packages/cryptography-0.6.1-py2.7-linux-x86_64.egg/cryptography/_Cryptography_cffi_36a40ff0x2bad1bae.so:  
symbol EC_GFp_nistp521_method, version OPENSSL_1.0.1 not defined in file libcrypto.so.1.0.0 with link time reference

I am wonder using latest openssl library for pyOpenssl, How can fix this issue?

Answer 1

You probably need to recompile cryptography against the newer version of OpenSSL.

Make sure you install the development headers for OpenSSL as well and then rebuild (perhaps most easily by just re-installing) cryptography.

The way you upgrade OpenSSL will vary depending on your platform. On Debian-derived systems this will probably be something like apt-get install libssl-dev (this will get you the library and development headers). On RedHat-derived systems it might be more like yum install libssl-devel.

You may want to investigate the use of virtualenv for this to keep your newly built versions separate from the already installed versions.

Once you have a virtualenv, you can install cryptography using pip:

path/to/virtualenv/bin/pip install cryptography

Or you can upgrade an existing installation:

path/to/virtualenv/bin/pip install --upgrade cryptography

Also note that the cryptography project now ships manylinux1 wheels. These are binary packages which include all dependencies - including OpenSSL. Therefore, if you are on a platform which can use a manylinux1 wheel, you do not need a separate OS installation of OpenSSL or its development headers.