Re: Warning about OpenSSL 1.0.2

On Oct 10, 2015, at 2:40 PM, Michael Ströder <michael@stroeder.com> wrote:

Which exact version of OpenSSL 1.0.2?

I'm not sure... I haven't seen people posting which version of OpenSSL they're using.

I'm asking because I'm running FreeRADIUS 3.0.10 (formerly 3.0.9) on openSUSE Tumbleweed (x86_64 and armv6l) with package openssl-1.0.2d-1.1 using EAP-TTLS/PAP without issue.

Maybe you're hitting the HMAC ABI incompatibility? It was fixed in 1.0.2c: https://www.openssl.org/news/changelog.html#x2

I don't think so. But who knows... If OpenSSL 1.0.2d fixes the problem, then we can leave 2.2.9 alone, and not do 2.2.10. It's almost like the OpenSSL people just write code, and release it without doing any tests. Alan DeKok.