How to link python to the manually compiled OpenSSL rather than the system's one

Question

I need to manually compile OpenSSL from source. I use Ubuntu 18. The OpenSSL shipped with Ubuntu 18 does not support specific cipher I need. But it can be enabled if I compile OpenSSL manually. I found this manual. However, how can I link python ssl to take the manually installed OpenSSL not the OS one?

Solution

You can't relink the existing Python installation and need to build another Python distribution from source. When building Python, you need to adapt CPPFLAGS, LDFLAGS and LD_LIBRARY_PATH env variables. Assuming you installed the custom OpenSSL in /path/to/openssl:

$ cd /path/with/Python/sources/unpacked/
$ export LDFLAGS="-L/path/to/openssl/lib/ -L/path/to/openssl/lib64/"
$ export LD_LIBRARY_PATH="/path/to/openssl/lib/:/path/to/openssl/lib64/"
$ export CPPFLAGS="-I/path/to/openssl/include -I/path/to/openssl/include/openssl"
$ ./configure --prefix=/path/to/custom/python/
$ make
$ make install

Now Python in /path/to/custom/python/ will use the custom OpenSSL:

$ /path/to/custom/python/bin/python -c "import ssl; print(ssl.OPENSSL_VERSION)"
OpenSSL 1.1.0h  27 Mar 2018

Comments

[Scott]

depending on the OS and environment, this may fail because it changes the default include paths (which may or may not be stored in local environment variables) and the configure will die saying the gcc does not properly compile. There is a --with-openssl flag in the ./configure however which can include a custom openssl compile directory. (run ./configure --help for details and look for openssl)

[hoefling]

@Scott --with-openssl is a relatively new flag (added in Python 3.7) which wasn't available at the time of writing the answer. It's also not backported to Python 3.6 and earlier; for newer versions, --with-openssl is definitely a better choice.