now that OpenSSL 3.1 is out, how do I install OpenSSL 3.0?

[franzinc]

Output of brew config

@max[git:master]$ brew config
HOMEBREW_VERSION: 4.0.9
ORIGIN: https://github.com/Homebrew/brew
HEAD: 584588afb4ab557bcc0536f2794b4d043c333bb9
Last commit: 12 hours ago
Core tap origin: https://github.com/Homebrew/homebrew-core
Core tap HEAD: 7c5b9efd09c515c1e8acce61c6e762177d4d7b05
Core tap last commit: 4 weeks ago
Core tap branch: master
Core tap JSON: 21 Mar 04:11 UTC
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_DISPLAY: max.known.net
HOMEBREW_EDITOR: emacsclient
HOMEBREW_MAKE_JOBS: 10
Homebrew Ruby: 2.6.10 => /System/Library/Frameworks/Ruby.framework/Versions/2.6/usr/bin/ruby
CPU: 10-core 64-bit arm_firestorm_icestorm
Clang: 14.0.0 build 1400
Git: 2.40.0 => /opt/homebrew/bin/git
Curl: 7.86.0 => /usr/bin/curl
macOS: 13.2.1-arm64
CLT: 14.2.0.0.1.1668646533
Xcode: N/A
Rosetta 2: false
@max[git:master]$ 

Output of brew doctor

@max[git:master]$ brew doctor
Your system is ready to brew.
@max[git:master]$ 

Description of issue

openssl@3 is 3.1.0 and if I do brew install [email protected] I get an error:

Warning: No available formula with the name "[email protected]". Did you mean openssl@3 or [email protected]?

The [email protected] implies that maybe [email protected] should (or will soon) work?

[ZhongRuoyu]

Currently, there is only [email protected] (1.1.1t) and openssl@3 (3.1.0); i.e., no [email protected] (3.0.8). But since it's an LTS version: I opened Homebrew/homebrew-core#126209.

Is there a use case where 3.1.0 doesn't work for you? If not, please use openssl@3 for now.

[franzinc]

I'm sure 3.1.0 works fine, but my software needs to be updated to "work" with it. We use the output of openssl version to constrain the dynamic loading to a known set, until we have time to test new versions. That in-between time is where we are right now, and it's frustrating that I updated one of my Macs and it has 3.1.0 not 3.0.0.

However, I just realized the fix is for me to install [email protected] for now. Thanks.

[vesper8]

[email protected] is out since a few days ago and it's breaking stuff.. can we please add [email protected] ?

[Bo98]

What issue are you seeing in PHP that is breaking with 3.2? Haven't heard of any issues so far and there's no known bugs upstream.

I could not get it to use [email protected]

Depends a bit. If it's just runtime library loading then you may need to adjust dyld search paths.

If it's properly linked in the binary, the best approach would be recompiling to change which it links to and to make sure it is not using newer APIs introduced in 3.2.

[vesper8]

@Bo98 After updating to OpenSSL 3.2 I am no longer able to use websockets via Pusher, Laravel, Laravel Valet and laravel-websockets on localhost. Works fine on production but on localhost I am getting cURL error 56: OpenSSL SSL_read: SSL_ERROR_SYSCALL, errno 0 and unable to verify the first certificate errors. This is in spite of me doing everything I can to ask my websockets implementation to not verify the host. I'm using self-signed certs on localhost. This was working fine before, and is working fine after I reverted to 3.14.

[vesper8]

There are quite a few issues already complaining about failed tests and regressions on OpenSSL 3.2. Here's one that I think may be the culprit of what's causing my issues openssl/openssl#22895

[Bo98]

Thanks, will get that fixed. Regressions unfortunately do happen - we've even seen them a couple times in patch level releases. But we can react to them and apply upstream patches when they happen.

here are quite a few issues already complaining about failed tests

All the others I see are non-x86_64/arm64 platforms which are tested less and not a concern for us. We run the OpenSSL test suite and verify it passes on the platforms we support.

[viniciusromani]

curl -L https://raw.githubusercontent.com/Homebrew/homebrew-core/e68186ba5a05a6ea9a30d6c7744de9a46bd3aadd/Formula/o/[email protected] > [email protected]

hey @vesper8 how did you find out this link to install 3.1.4 version? I need to install exactly the 3.2.0 version and I am not sure where to look at.

to contextualize: I am trying to create postgis extension on a postgres database; I've run brew install postgis to install dependency but brew also updated my openssl version to 3.3 which was (unfortunate for me) launched this month and now I get the following error when trying to CREATE EXTENSION postgis:

SQL Error [58P01]: ERROR: could not load library "/home/linuxbrew/.linuxbrew/lib/postgresql@14/postgis-3.so": /home/linuxbrew/.linuxbrew/opt/openssl@3/lib/libssl.so.3: version `OPENSSL_3.2.0' not found (required by /home/linuxbrew/.linuxbrew/opt/curl/lib/libcurl.so.4)

[EreMaijala]

@vesper8 Did your issue with OpenSSL SSL_read: SSL_ERROR_SYSCALL, errno 0 get resolved with OpenSSL 3.2.1? I'm having the same issue with PHP 8.3.4 on up-to-date Homebrew (Apple Silicon).

[Niq1982]

Having the same OpenSSL SSL_read: SSL_ERROR_SYSCALL, errno 0 issue here with Apple M3 Pro and Laravel Valet. Have tried with PHP versions 8.2.17 and 8.3.4, both are installed using homebrew and both use OpenSSL 3.2.1. I couldn't find a working way to go back using to OpenSSL 3.1.x with any PHP versions, so kind of stuck here without an ability to run curl through PHP in my local environment. I suggest turning homebrew PHP back to OpenSSL 3.1.1 since there's such major issues with 3.2.1

[SMillerDev]

Can you give a small example script? Because I have not encountered such issues.

[EreMaijala]

@SMillerDev It seems to only happen with some sites. I haven't got an openly accessible example that does it reliably, but this does it intermittently (with the default address in the script) - sometimes several of the 10 requests fail, sometimes none:

<?php

for ($try = 1; $try <= 10; $try++) {
  echo "Try $try..." . PHP_EOL;
  $ch = curl_init($argv[1] ?? 'https://api-na.hosted.exlibrisgroup.com/primo/v1/search');
  curl_setopt($ch, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
  curl_setopt($ch, CURLOPT_HTTPHEADER, ['User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36']);
  curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  curl_setopt($ch, CURLOPT_FRESH_CONNECT, 1);
  curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5);
  curl_setopt($ch, CURLOPT_TIMEOUT, 30);
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  //curl_setopt($ch, CURLOPT_VERBOSE, 1);
  $result = curl_exec($ch);
  if ($errno = curl_errno($ch)) {
    echo "Request failed ($errno): " . curl_error($ch) . PHP_EOL;
  } else {
    echo 'Request successful. Retrieved ' . strlen($result) . ' bytes' . PHP_EOL;
  }
  curl_close($ch);
  sleep(1);
}