As part of the installation a PHP 5.4 cartridge from openshift.com on my Mac with OS X 10.10.5 in the Terminal I noticed a message about it loading OpenSSL 0.9.8 for compatibilty with PHP.

Later, trying to install getcomposer.org it is giving me a warning:

Some settings on your machine may cause stability issues with Composer.
If you encounter issues, try to change the following:

The OpenSSL library (0.9.8zc) used by PHP does not support TLSv1.2 or TLSv1.1. If possible you should upgrade OpenSSL to version 1.0.1 or above.

openssl version command in terminal reported OpenSSL 0.9.8zg 14 July 2015

Should I update to OpenSSL version 1.0.1?

migrated from security.stackexchange.com Feb 6 '16 at 15:45

This question came from our site for information security professionals.

  • 1
    From OpenSSL website: The 0.9.8 and 1.0.0 versions are now out of support and should not be used. – Vilican Feb 6 '16 at 15:33
  • Define "safe"? If you are asking if there are known vulnerabilities, that's an easy thing to check. As for the rest of your questions, that's a really Mac-specific question and perhaps better suited for SuperUser or AskDifferent? – schroeder Feb 6 '16 at 15:34
  • Also see Warning: openssl-1.0.2g already installed when using HomeBrew and How to upgrade OpenSSL version used by PHP on Stack Overflow. The questions are mostly off-topic for the site, but the site is polluted with off-topic questions because developers feel they can ask anything. – user83961 Jun 6 '16 at 6:17

OpenSSL 0.9.8zc or 0.9.8zg does not support TLSv1.1/1.2 which can cause vulnerabilities while downloading using HTTPS links.

You should update OpenSSL to latest version from official site.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .