Warning about OpenSSL 1.0.2

Alan DeKok aland at deployingradius.com
Sun Oct 11 15:01:30 CEST 2015

On Oct 10, 2015, at 2:40 PM, Michael Ströder <michael at stroeder.com> wrote:
> Which exact version of OpenSSL 1.0.2?

  I'm not sure... I haven't seen people posting which version of OpenSSL they're using.

> I'm asking because I'm running FreeRADIUS 3.0.10 (formerly 3.0.9) on openSUSE
> Tumbleweed (x86_64 and armv6l) with package openssl-1.0.2d-1.1 using
> EAP-TTLS/PAP without issue.
> Maybe you're hitting the HMAC ABI incompatibility?
> It was fixed in 1.0.2c:
> https://www.openssl.org/news/changelog.html#x2

  I don't think so.  But who knows...

  If OpenSSL 1.0.2d fixes the problem, then we can leave 2.2.9 alone, and not do 2.2.10.

  It's almost like the OpenSSL people just write code, and release it without doing any tests. 

  Alan DeKok.

More information about the Freeradius-Users mailing list