Python and OpenSSL version reference issue on OS X

Question

Trying to resolve an OpenSSL version issue I'm having.

It seems that I have three different versions of OpenSSL on my Mac.

1. Python 2.7.11 has version 0.9.7m:

    python -c "import ssl; print ssl.OPENSSL_VERSION" OpenSSL 0.9.7m 23 Feb 2007

2. At the Terminal:

    openssl version OpenSSL 1.0.1h 5 Jun 2014

3. Recently Compiled / Installed:

    /usr/local/ssl/bin/openssl OpenSSL> version OpenSSL 1.0.2h 3 May 2016 OpenSSL>

I recently upgraded my OS X to 10.11.5. In the process, caused an issue for previously working python scripts. Below is the error message snippet:

Python Error Message:

 You are linking against OpenSSL 0.9.8, which is no longer *
 RuntimeError: You are linking against OpenSSL 0.9.8, which is no longer support by the OpenSSL project. You need to upgrade to a newer version of OpenSSL.

(* - yes, this is how the error message looks like. It's trimmed in the middle of the sentence.)

Any recommendations on resolving this issue would be greatly appreciated. What I'd like is to have Python reference the OpenSSL version 1.0.2h vs the outdated version 0.9.7m.

I've tried installing Python and OpenSSL many times using various post / blogs for guidance without any luck.

Answer 1

Use this as a workaround:

export CRYPTOGRAPHY_ALLOW_OPENSSL_098=1

This appears to be a recent check of the hazmat cryptography library. You can see the source code at:

https://github.com/pyca/cryptography/blob/master/src/cryptography/hazmat/bindings/openssl/binding.py#L221

The CRYPTOGRAPHY_ALLOW_OPENSSL_098 environment variable downgrades the error to a deprecation warning, if you are willing to take the risk. I also ran into this on OS X in just the past day, so something changed recently.

Answer 2

You can install a version of python that uses a newer version of openssl.

First you can brew install a new version of open SSL

brew update
brew install openssl
brew link --force openssl

You should see a newer version with

openssl version -a

Then you can install a different version of python which uses that newer version of openssl. If you use pyenv , that would be:

CFLAGS="-I$(brew --prefix openssl)/include" \
LDFLAGS="-L$(brew --prefix openssl)/lib" \
pyenv install -v 3.4.3

You can find more information about installing a version of python with a brew installed version of openssl here: https://github.com/yyuu/pyenv/wiki/Common-build-problems

Answer 3

This problem almost kills me!!!! Finally my guy solved this only by lowering the version of the package "paramiko" from 2.* to 1.*（like 1.15.4 I set）can solve!

Answer 4

If you are getting You are linking against OpenSSL 1.0.0 then use export CRYPTOGRAPHY_ALLOW_OPENSSL_098=1 environment variable to bypass it. Thanks @braddock

Answer 5

SOLVED NO HACKS, none of the above worked for me. I ended up taking a simpler and uncomplicated approach....

1. Install python 2.7.13 from the official site, it actually installs as the default python, replacing the old python system wide.

https://www.python.org/downloads/mac-osx/

2. Upgrade openssl after the python install.

sudo pip install --upgrade pyOpenSSL

3. You will have to re-install all your python modules ( because you replaced python ), I strongly recommend using pip. After a few minutes of pip installs my default OSX python was upgraded, I had openssl upgraded, and I had all my modules ( including django running ).