Support OpenSSL-3.0

[saulwold]

Currently when building the azure-c-shared-utility using OpenSSL 3.0 a number of errors occur during compliation:

adapters/x509_openssl.c:79:28: error: invalid use of incomplete typedef 'SSL_CTX' {aka 'struct ssl_ctx_st'}
if (ssl_ctx->extra_certs != NULL)
^~
In file included from usr/include/openssl/ssl.h:31,
from inc/azure_c_shared_utility/x509_openssl.h:7,
from adapters/x509_openssl.c:4:

adapters/x509_openssl.c:148:9: error: 'SSL_CTX_use_RSAPrivateKey' is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
if (SSL_CTX_use_RSAPrivateKey(ssl_ctx, privatekey) != 1)
^~
In file included from inc/azure_c_shared_utility/x509_openssl.h:7,
from adapters/x509_openssl.c:4:

/usr/include/openssl/ssl.h:1798:12: note: declared here
__owur int SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa);
^~~~~~~~~~~~~~~~~~~~~~~~~

adapters/x509_openssl.c:160:9: error: 'RSA_free' is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
RSA_free(privatekey);
^~~~~~~~

[danewalton]

Yes at the moment we don't support OpenSSL 3.0. It is not currently on our roadmap but I will convert this to a discussion as a feature ask.

[yunhaoling]

hey team, I'm have another customer asking for OpenSSL 3.0 support, issue is here: Azure/azure-uamqp-python#276.

[Thomas1664]

There is only one error that prevents use of OpenSSL 3:

/mnt/vcpkg-ci/buildtrees/azure-c-shared-utility/src/38163cefc7-1f7ff84507.clean/adapters/x509_openssl.c: In function ‘load_certificate_chain’:
/mnt/vcpkg-ci/buildtrees/azure-c-shared-utility/src/38163cefc7-1f7ff84507.clean/adapters/x509_openssl.c:81:28: error: dereferencing pointer to incomplete type ‘SSL_CTX’ {aka ‘struct ssl_ctx_st’}
   81 |                 if (ssl_ctx->extra_certs != NULL)
      |                            ^~

[Thomas1664]

You already have a PR addressing this error since November: #577

[saulwold]

Status Check?

[major]

As mentioned over in the uamqp issue, OpenSSL 3.x would be very helpful for RHEL 9 and its derivatives (CentOS, Rocky, Alma, etc) which have made the move completely to OpenSSL 3.0.

(I package uamqp for Fedora/CentOS.)

[dustinchilson]

Ubuntu has dropped support completely for 21.04 and 21.10, 22.04 the latest LTS is using OpenSSL-3.0.

[danewalton]

We are aware and have it in our backlog to prioritize. For now, we recommend using the OPENSSL_NO_DEPRECATED compile define to continue to use the APIs.

[Thomas1664]

This won't solve the problem. There is already PR #577 that will fix the issue. All you have to do is merge it.

[danewalton]

Hey all,
We merged a PR here which adds appropriate build flags to allow the code to be compiled with OpenSSL 3.

#604