I am using Server app 3 with OSX 10.9.5, that came with Openssl 0.9.8zg, and since this version dont allow TLS 1.2, i decided to do an upgrade to OpenSSL 1.0.2j.

Since this OpenSSL came by default, i cannot just simply upgrade it, so i used macports to install a newer version, to see if i could use it instead of the other version.

After i made the installation i notice that i was only able to use the newer version in non-root user (through command line), if i login to root i continue to use the older version.

So i add the location of macports at 'paths' file, and then i was able to use openssl also in root.

But now i dont know for sure if my Server App (aka system) is using the right OpenSSL or not.

Right now i have not change any certificate, i am using the default one that came in the older version. I never have used openssl before and i am still trying to understand how it works.

If i try to use openssl in root or in a non-root user, in my server i get this output with an error:

remote:~ root# openssl s_client -connect remote.X.pt:443 -tls1_2
140735302370144:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:362:
no peer certificate available
No client certificate CA names sent
SSL handshake has read 5 bytes and written 7 bytes
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
    Protocol  : TLSv1.2
    Cipher    : 0000
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1480421165
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)

Where it seems that TLS 1.2 is supported, but if i try with an outside service such as SSLlabs, i got this:

TLS 1.2 No
TLS 1.1 No
TLS 1.0 Yes
SSL 3   No
SSL 2   No

So my question is if my system continues to use the older version libraries, or if there is anything in the certificate that says that this server just allow TLS 1.0? If it continues to use the older version libraries how can i point to new version libraries?


Just confirm in phpinfo that i am still using the older version. So my question is how can i replace openssl with the new version in macports?

  • To be clear, that s_client did NOT indicate TLS 1.2 is supported (and you have confirmed it isn't). Also the certificate has no effect at all on protocol version, and usually not ciphersuites either. (Version 1.2 does affect ciphersuites.) But these do not help with your actual problem of getting Server to use the newer openssl, I'm afraid. (edit) I originally suggested apple.SX but I now see you already tried that. – dave_thompson_085 Nov 29 '16 at 14:57

Server.app comes with precompiled binaries that link against Apple's OpenSSL in /usr/lib. While you can set $PATH to change which programs you execute on the command line, $PATH does not affect libraries linked by software.

This leads to a couple of thoughts:

  • You'd have to recompile Server.app against the MacPorts OpenSSL. Since you don't have the exact source code for Server.app, that's not an option.
  • You could compile your own server against MacPorts' OpenSSL. MacPorts ships most open source webservers, but you'll have to configure them yourself.
  • If two libraries are binary-compatible, you can set a special environment variable to tell the macOS loader to ignore the absolute path where it expects the library and search a different path first. Unfortunately in the case of OpenSSL 0.9.8 vs 1.0.0, the libraries are not binary-compatible (/usr/lib/libssl.0.9.8.dylib vs. /opt/local/lib/libssl.1.0.0.dylib), so that's not an option here.

As a consequence, I don't see a way to make Server.app 3 use TLS 1.2, unfortunately.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.