I need to upgrade Openssl to 1.0.2 to get a certain feature. This worked following this tutorial http://www.miguelvallejo.com/updating-to-openssl-1-0-2g-on-ubuntu-server-12-04-14-04-lts-to-stop-cve-2016-0800-drown-attack/ However, HAProxy for example is still built with the old openssl version and thus does not support the ssl feature I need

How do I upgrade without compiling? I tried apt-get update and upgrade and also dist-upgrade. All that did not bring me to version 1.0.2

  • You need to find a version of HAProxy that is linked to the newer version of the OpenSSL library. If one does not exist, then you have to recompile it. – Tero Kilkanen Dec 30 '16 at 16:10
  • 2
    Does Ubuntu not backport security fixes to it's LTS environments ? Check the release notes for your installed openssl - it may have the patches applied. – user9517 Dec 30 '16 at 16:11
  • Use a distribution that shipped with OpenSSL 1.0.2. It is extremely unsafe to attempt to replace critical path libraries such as this, and the premise behind that Internet tutorial is wrong, making it pretty useless. – Michael Hampton Dec 30 '16 at 19:10
  • Well replacing ubuntu 14.04 Lts or uprgrading it is out of question. It is a server cluster and this would result in way to much work/cost. Is there not another way? My goal is to upgrade to HTTP/2 which needs OpenSSL 1.0.2 – merlin Dec 30 '16 at 19:14
  • Says "sudo apt-get install php5-curl (Install cURL library)"? – K-Gun Aug 1 '17 at 11:36

As mentioned here, this openssl 1.0.2 is supported till 31st December, 2019

  1. Download source from https://www.openssl.org/source/openssl-1.0.2n.tar.gz
  2. Extract it to a folder
  3. Go to the extracted folder and use the following command

    sudo ./config && sudo make && sudo make install
  4. It will take some time to install

  5. Link the newly installed openssl

    sudo ln -sf /usr/local/ssl/bin/openssl `which openssl`
  6. Check the version and make sure that it is installed.

    openssl version -v
  • ...Sort of...Python doesn't seem to be able to use it, so pip installs fail. – Gabriel Staples Sep 2 '18 at 5:20
  • 1
    Solution: forget about Python 3.7 and just install Python 3.6.6 instead! Installation instructions here: stackoverflow.com/a/44758621/4561887. This way, we forego the whole necessity of having openssl 1.0.2 (I no longer need it) and pip just works! – Gabriel Staples Sep 2 '18 at 5:36

This article has a complete answer. https://www.miguelvallejo.com/tag/installing-openssl-1-0-2g-on-ubuntu/

cURL Method

sudo apt-get install php5-curl (Install cURL library)
sudo apt-get install make (Install compiling library Make)
curl https://www.openssl.org/source/openssl-1.0.2l.tar.gz | tar xz && cd openssl-1.0.2l && sudo ./config && sudo make && sudo make install (single command that will download latest binaries, extract them, cd into the directory, compile configuration and then install the files)
sudo ln -sf /usr/local/ssl/bin/openssl ‘which openssl’ (This will create a sym link to the new binaries)
openssl version -v (Used to check the version of the Current OpenSSL binaries)

wget method

sudo apt-get install make (Install compiling library Make)
wget https://www.openssl.org/source/openssl-1.0.2l.tar.gz (Download the latest OpenSSL 1.0.2g binaries)
tar -xzvf openssl-1.0.2l.tar.gz (Extract the tar ball to the local directory)
cd openssl-1.0.2l (Enter extracted OpenSSL directory)
sudo ./config (Configure binaries for compiling)
sudo make install (install configured binaries)
sudo ln -sf /usr/local/ssl/bin/openssl which openssl (This will create a sym link to the new binaries)
openssl version -v (Used to check the version of the Current OpenSSL binaries)


You might need this to install "add-apt-repository":

sudo apt-get update && apt-get install -y software-properties-common

This will get you up to v1.0.2g without the need to compile:

openssl version -a
sudo add-apt-repository ppa:0k53d-karl-f830m/openssl
sudo apt-get update
sudo apt-get install openssl
openssl version -a

  • 2
    Adding a non-official repository for security software like OpenSSL is highly questionable and should be avoided. – Bdoserror Dec 12 '17 at 22:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.