Undefined references when building OpenSSL

Question

I need to build my own OpenSSL binary because the package supplied with Fedora-18 does not have elliptic curve cryptography. I execute these commands:

./config --prefix=/home/USERNAME/bin/ssl --openssldir=/home/USERNAME/bin/ssl/openssl -fPIC zlib no-idea no-mdc2 no-rc5
make depend
make

But I have linking errors:

../libcrypto.a(x86_64cpuid.o): In function `OPENSSL_cleanse':
(.text+0x1a0): multiple definition of `OPENSSL_cleanse'
../libcrypto.a(mem_clr.o):mem_clr.c:(.text+0x0): first defined here
../libcrypto.a(cmll-x86_64.o): In function `Camellia_cbc_encrypt':
(.text+0x1f00): multiple definition of `Camellia_cbc_encrypt'
../libcrypto.a(cmll_cbc.o):cmll_cbc.c:(.text+0x0): first defined here
../libcrypto.a(aes-x86_64.o): In function `AES_encrypt':
(.text+0x460): multiple definition of `AES_encrypt'
../libcrypto.a(aes_core.o):aes_core.c:(.text+0x62a): first defined here
../libcrypto.a(aes-x86_64.o): In function `AES_decrypt':
(.text+0x9f0): multiple definition of `AES_decrypt'
../libcrypto.a(aes_core.o):aes_core.c:(.text+0xad0): first defined here
../libcrypto.a(aes-x86_64.o): In function `private_AES_set_encrypt_key':
(.text+0xab0): multiple definition of `private_AES_set_encrypt_key'
../libcrypto.a(aes_core.o):aes_core.c:(.text+0x0): first defined here
../libcrypto.a(aes-x86_64.o): In function `private_AES_set_decrypt_key':
(.text+0xd80): multiple definition of `private_AES_set_decrypt_key'
../libcrypto.a(aes_core.o):aes_core.c:(.text+0x403): first defined here
../libcrypto.a(aes-x86_64.o): In function `AES_cbc_encrypt':
(.text+0xfa0): multiple definition of `AES_cbc_encrypt'
../libcrypto.a(aes_cbc.o):aes_cbc.c:(.text+0x0): first defined here

Answer 1

I had the same problem compiling OpenSSL 1.0.1e on SLES 11 Linux. On another web site I found the hint to issue a "make clean" before calling make.

In my case, the unsucessful first attempt was:

Logged on as a normal user (not root):

. ./config
make

This failed with the same errors you mentioned in your question.

The successful attempt was:

su
make clean
./config zlib
make
make install

Answer 2

./config --prefix=/home/USERNAME/bin/ssl --openssldir=/home/USERNAME/bin/ssl/openssl -fPIC zlib no-idea no-mdc2 no-rc5
make depend
make

For -fPIC, you use shared.

There's no need for --prefix because it will use --openssldir. So the configuration invocation would be similar to:

./config shared zlib no-idea no-mdc2 no-rc5 no-ssl2 no-ssl3 \
    enable-ec_nistp_64_gcc_128 --openssldir=/home/USERNAME/bin/ssl/openssl

Some notes on the line:

• enable-ec_nistp_64_gcc_128 is a speed-up for 64-bit platforms where GCC offers a 128-bit integer.
• Usually, you want no-comp because compression can leak information
• Because compression leaks information, you usually don't want zlib
• no-ssl2 completely removes SSLv2 because its insecure
• no-ssl3 completely removes SSLv3 because its insecure

--openssldir=/home/USERNAME/bin/ssl/openssl means:

• binaries will be in /home/USERNAME/bin/ssl/openssl/bin
• libraries will be in /home/USERNAME/bin/ssl/openssl/lib
• headers will be in /home/USERNAME/bin/ssl/openssl/include

Then, you only need to run the following. There's no need for make depend.

$ make
$ sudo make install

---

If you need to clean an existing configuration and then reconfigure, perform the following:

make clean && make dclean

make dclean is the key to re-configuring.

---

Also see Compilation and Installation on the OpenSSL wiki.