I'm on osx 10.11.

(Background: I'm having trouble getting the system installed Python to use TLS 1.1.)

From what I've read I need to use brew to manage Python. But I want to upgrade openssl first so Python picks up the right version?

I did brew update, brew upgrade, brew doctor (no problems)

Then I tried:

$ brew install openssl
Warning: openssl-1.0.2h_1 already installed
$ brew link openssl --force
Linking /usr/local/Cellar/openssl/1.0.2h_1... 
Error: Could not symlink ../../../opt/openssl/include/openssl/aes.h
/opt/openssl/include/openssl is not writable.
$ brew link --force openssl
Linking /usr/local/Cellar/openssl/1.0.2h_1... 1601 symlinks created

I'm not sure if those worked on not, but here's where I am now:

$ openssl version
OpenSSL 0.9.8zg 14 July 2015
$ which openssl
$ ls -l /usr/local/bin/openssl
lrwxr-xr-x  1 greg  admin  46 Jun 27 15:23 /usr/local/bin/openssl -> /usr/local/Cellar/openssl/1.0.2h_1/bin/openssl
$ /usr/local/Cellar/openssl/1.0.2h_1/bin/openssl version
OpenSSL 1.0.2h  3 May 2016

So it seems like I might have installed the upgraded openssl version but am I ready to do brew install python and it will get the right openssl version and let me use TLS 1.1? (Is this even the right approach to get TLS 1.1 support for Python?)

  • Something is clearly wrong, you should get OpenSSL 1.0.2h 3 May 2016 for openssl version. What's the output of command -V openssl? – techraf Jun 28 '16 at 0:48
  • Hmm, after a restart it all seems to be working properly. Maybe there was something pointing to the old one somehow. I'm thinking to install Python manually instead of using brew. – Greg Jun 28 '16 at 13:09

solution to install from source and get around the homebrew error

brew install openssl

-> Warning: openssl-1.0.2j already installed, it's just not linked.

brew link openssl

->Warning: Refusing to link: openssl Linking keg-only openssl means you may end up linking against the insecure, deprecated system OpenSSL while using the headers from Homebrew's openssl. Instead, pass the full include/library paths to your compiler e.g.: -I/usr/local/opt/openssl/include -L/usr/local/opt/openssl/lib

cd ~/scratch
git clone git@github.com:openssl/openssl.git
cd openssl
sudo mkdir /usr/local/ssl
sudo chmod 777 /usr/local/ssl
./config -I/usr/local/opt/openssl/include -L/usr/local/opt/openssl/lib
make test
make install

now, you will think you failed. but per OpenSSL not getting linked with homebrew on El Capitan 10.11.6 you have to close your terminal then reopen it now

openssl version -a

will show that you are using the new version.

  • 1
    Running hash -r (or just opening a new tab) may work better than restarting Terminal.app – nohillside Dec 15 '16 at 20:55

Using: git clone git@github.com:openssl/openssl.git resulted in

Permission denied (publickey).
fatal: Could not read from remote repository.

I poked around the internet and then tried:

git clone git://git.openssl.org/openssl.git

and that worked.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .