find_package(OpenSSL) unable to find specific libssl version

Question

I'm working on a RHEL7 system with OpenSSL versions 1.0.2k and 0.9.8e installed:

$ ll /usr/lib64/libssl.so*   
lrwxrwxrwx 1 root root     16 Feb 28 19:32 /usr/lib64/libssl.so -> libssl.so.1.0.2k
-rwxr-xr-x 1 root root 340832 Mar  4  2016 /usr/lib64/libssl.so.0.9.8e
-rwxr-xr-x 1 root root 470360 Apr  9  2019 /usr/lib64/libssl.so.1.0.2k
lrwxrwxrwx 1 root root     16 Feb 28 19:31 /usr/lib64/libssl.so.10 -> libssl.so.1.0.2k
lrwxrwxrwx 1 root root     16 Jun 22  2018 /usr/lib64/libssl.so.6 -> libssl.so.0.9.8e

For compatibility reasons, my program needs to link against the old 0.9.8e version, but find_package() for OpenSSL does not seem able to find it. If I use find_package(OpenSSL 0.9.8 REQUIRED COMPONENTS SSL Crypto) it finds the newer version:

-- Found OpenSSL: /usr/lib64/libcrypto.so (found suitable version "1.0.2k", minimum required is "0.9.8") found components: SSL Crypto

If I add the EXACT option, CMake tells me that the version could not be found:

CMake Error at /path/to/cmake/data/share/cmake-3.17/Modules/FindPackageHandleStandardArgs.cmake:164 (message):
  Could NOT find OpenSSL, try to set the path to OpenSSL root folder in the
  system variable OPENSSL_ROOT_DIR: Found unsuitable version "1.0.2k", but
  required is exact version "0.9.8" (found /usr/lib64/libcrypto.so)

Looking at the output it is evident that FindOpenSSL.cmake is only looking at the symlink that points to the newer library. Providing OPENSSL_ROOT_DIR is no option either, as both libraries reside in the same directory. Is it possible to tell the command to look for a specific library/SONAME?

I don't feel like directly linking against the correct library. Should I report a bug to KitWare? To me it looks like the command is broken in this respect.

Answer 1

I would recommend you to upgrade your application to become compatible with openssl 1.0.x or 1.1.x.

That being said, in the spirit of answering this question, you can do the following:

mkdir $HOME/openssl0.9.8e && cd $_
wget http://vault.centos.org/5.11/os/x86_64/CentOS/openssl-0.9.8e-27.el5_10.4.x86_64.rpm
wget http://vault.centos.org/5.11/os/x86_64/CentOS/openssl-devel-0.9.8e-27.el5_10.4.x86_64.rpm
for i in *.rpm; do rpm2cpio $i | cpio -idmv; done
cd ..

# If you are using CMake 2.x
cmake -S /path/to/your/project -Bbuild \
   -DOPENSSL_INCLUDE_DIR=$HOME/openssl0.9.8e/usr/include \
   -DOPENSSL_SSL_LIBRARY=$HOME/openssl0.9.8e/usr/lib64/libssl.so \
   -DOPENSSL_CRYPTO_LIBRARY=$HOME/openssl0.9.8e/usr/lib64/libcrypto.so

# If you are using CMake 3.x
cmake3 -S /path/to/your/project -Bbuild -DOPENSSL_ROOT_DIR=$HOME/openssl0.9.8e/usr

OPENSSL_ROOT_DIR can't be properly used with 2.x because of a fix which is available only in 3.x.

Sample content for the CMakeLists.txt:

cmake_minimum_required(VERSION 3.0.0)

project(so)

find_package(OpenSSL 0.9.8 REQUIRED COMPONENTS SSL Crypto EXACT)

add_executable(main main.x.c)
target_link_libraries(main PRIVATE ${OPENSSL_LIBRARIES})
target_include_directories(main PRIVATE ${OPENSSL_INCLUDE_DIR})

To run the binary after building it, you can either install the compat package: openssl098e on CentOS7/RHEL7 or use:

LD_LIBRARY_PATH=$HOME/openssl0.9.8e/lib64 /path/to/build/main

Please note that you'll also need to install krb5-devel as it is a dependency for using libssl.

You can also vendor the libraries along with your application and have $ORIGIN in RPATH, but I'll leave that as an exercise (for fun) and highly not recommend it as you should update your app to make it complaint with openssl 1.0.x or 1.1.x and since you won't be getting any updates for 0.9.8 libs, ever, so it is a huge security concern.