Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Today the heartbleed OpenSSL exploit was announced in the wild, which allows an attacker to surreptitiously detect and steal private server keys (allowing them to MitM and decrypt your encrypted data and steal passwords). This affects OpenSSL versions including 1.0.1f which is the version on my up-to-date Mavericks computer Mac (because I used port/brew to install other software which updated my openssl without me realizing it):

$ openssl version
OpenSSL 1.0.1f 6 Jan 2014

This demonstrates I am not using the Mavericks version of OpenSSL:

$ which openssl

OpenSSL released a fix today in 1.0.1g and I wonder how I can get this fixed version installed over my current version?

share|improve this question
You are not using the version that came with OS X Mavericks -- that's 0.9.8y, which does not have the heartbleed bug (it was introduced in 1.0.1). Your best update path will depend on where and how you installed the newer version. which openssl might be informative. Also, the major problem isn't the openssl command, it's the openssl libraries (which are used by other programs) -- those aren't API compatible between versions 0.9.x and 1.0.x, so you do not want to update the system-supplied openssl libraries! – Gordon Davisson Apr 8 '14 at 5:13
@GordonDavisson - You are totally right. I was mistaken. I had apparently installed MacPort at some point on this machine which upgraded my openssl. (Probably when I was trying to get python2.7 working). Probably should delete this question, but won't in case others make the same mistake find SapphireSun's great answer useful). – dr jimbob Apr 8 '14 at 5:31
With that clarifying update, I'd leave it. There are probably other people in the same boat, and having this here should give them an idea what needs to be done. – Gordon Davisson Apr 8 '14 at 5:38
If you install OpenSSL with brew it will not link the binaries to /usr/bin. Therefore it will not be run if you issue an openssl on command line. – Max Ried Apr 9 '14 at 21:16
@MaxRied how do you run the version that homebrew installed? I installed new openssl by instructions in accepted answer, and openssl version returns 1.0.1g, but you're saying openssl commands aren't using that version? – inorganik Apr 23 '14 at 17:15
up vote 106 down vote accepted

For what it's worth, I just used homebrew (

brew update
brew install openssl
brew link --force openssl

openssl version -a

If one of the bad versions come up (1.0.1a-f), you can figure out which version of openssl you're using, this way:

which openssl

Often this is from /usr/bin. To make sure you get the updated version, drop a symlink into /usr/local/bin to point to the updated openssl, like this:

ln -s /usr/local/Cellar/openssl/1.0.1g/bin/openssl /usr/local/bin/openssl

As an alternative to that final step, some people replace the openssl in /usr/bin with a symlink to /usr/local/Cellar/openssl/1.0.1g/bin/openssl (or whatever your version is):

mv /usr/bin/openssl /usr/bin/openssl_OLD
ln -s /usr/local/Cellar/openssl/1.0.1g/bin/openssl /usr/bin/openssl

But this is known to cause problems with some more recent versions of OSX. Better to just insert a new symlink into /usr/local/bin, which should take precedence on your path over /usr/bin.

share|improve this answer
Don't delete the original—just rename it. If you find the Homebrew-built version doesn't work for some purpose, there's no reason to put yourself up a creek without a (working) paddle. – Terry N Apr 8 '14 at 4:52
Fair enough, but on the other hand, I wouldn't call that version working... – SapphireSun Apr 8 '14 at 4:59
Even with the vulnerability, it's still useful to you in any situation in which you're willing to take the calculated risk in order to get app X (that depends on it) to work briefly. Or, if you prefer... "working" in the sense that a broken paddle can still push water. :-p – Terry N Apr 8 '14 at 5:48
Just a note - after performing these steps, typing "openssl" in the terminal window failed with a "no such file or directory" error pointing to the old copy (but it did work in a new terminal window). To fix the terminal window I was working in, I needed to do a: hash -r – Mike Hedman Apr 11 '14 at 21:28
Better than creating a symlink at /usr/bin/openssl, one can create the link at /usr/local/bin/openssl. That should precede /usr/bin on your $PATH and bypass any problems arising from "System Integrity Protection" in newer versions of OS X. – mrKelley Apr 5 at 20:45

Or for those who are using mac ports, and are not worried about keeping the version

sudo port upgrade openssl

simples :-)

share|improve this answer
sudo port upgrade outdated also works. – dr jimbob Apr 8 '14 at 16:51
That's funny, having both macports and brew both install openssl on my machine was actually the cause of this happening to me. Running sudo port -f uninstall openssl @<old-version> did the trick for me :) – yair Mar 14 at 22:51
@yair having both macports and homebrew will cause many problems – Mark May 26 at 10:45

protected by Community Apr 9 '14 at 21:00

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.