ssl-cert-by-lua branch compilation error

[subnetmarco]

I am experiencing an issue compiling ssl-cert-by-lua on OS X 10.10, with the following error:

  "_X509_get1_ocsp", referenced from:
      _ngx_ssl_stapling in ngx_event_openssl_stapling.o
      _ngx_http_lua_ffi_ssl_get_ocsp_responder_from_der_chain in ngx_http_lua_sslcertby.o
  "_X509_get_issuer_name", referenced from:
      _ngx_ssl_get_issuer_dn in ngx_event_openssl.o
  "_X509_get_serialNumber", referenced from:
      _ngx_ssl_get_serial_number in ngx_event_openssl.o
  "_X509_get_subject_name", referenced from:
      _ngx_ssl_get_subject_dn in ngx_event_openssl.o
  "_X509_verify_cert_error_string", referenced from:
      _ngx_http_process_request in ngx_http_request.o
      _ngx_http_upstream_ssl_handshake in ngx_http_upstream.o
      _ngx_http_lua_ssl_handshake_handler in ngx_http_lua_socket_tcp.o
  "_d2i_OCSP_RESPONSE", referenced from:
      _ngx_ssl_stapling in ngx_event_openssl_stapling.o
      _ngx_ssl_stapling_ocsp_handler in ngx_event_openssl_stapling.o
      _ngx_http_lua_ffi_ssl_validate_ocsp_response in ngx_http_lua_sslcertby.o
  "_d2i_PrivateKey_bio", referenced from:
      _ngx_http_lua_ffi_ssl_set_der_private_key in ngx_http_lua_sslcertby.o
  "_d2i_SSL_SESSION", referenced from:
      _ngx_ssl_get_cached_session in ngx_event_openssl.o
  "_d2i_X509_bio", referenced from:
      _ngx_http_lua_ffi_ssl_set_der_certificate in ngx_http_lua_sslcertby.o
      _ngx_http_lua_ffi_ssl_get_ocsp_responder_from_der_chain in ngx_http_lua_sslcertby.o
      _ngx_http_lua_ffi_ssl_create_ocsp_request in ngx_http_lua_sslcertby.o
      _ngx_http_lua_ffi_ssl_validate_ocsp_response in ngx_http_lua_sslcertby.o
  "_i2a_ASN1_INTEGER", referenced from:
      _ngx_ssl_get_serial_number in ngx_event_openssl.o
  "_i2d_OCSP_REQUEST", referenced from:
      _ngx_ssl_certificate_status_callback in ngx_event_openssl_stapling.o
      _ngx_http_lua_ffi_ssl_create_ocsp_request in ngx_http_lua_sslcertby.o
  "_i2d_OCSP_RESPONSE", referenced from:
      _ngx_ssl_stapling in ngx_event_openssl_stapling.o
  "_i2d_SSL_SESSION", referenced from:
      _ngx_ssl_new_session in ngx_event_openssl.o
  "_i2d_X509", referenced from:
      _ngx_http_lua_ffi_cert_pem_to_der in ngx_http_lua_sslcertby.o
  "_sk_free", referenced from:
      _ngx_http_lua_ffi_ssl_validate_ocsp_response in ngx_http_lua_sslcertby.o
  "_sk_new_null", referenced from:
      _ngx_http_lua_ffi_ssl_validate_ocsp_response in ngx_http_lua_sslcertby.o
  "_sk_num", referenced from:
      _ngx_ssl_session_cache in ngx_event_openssl.o
      _ngx_ssl_stapling in ngx_event_openssl_stapling.o
  "_sk_push", referenced from:
      _ngx_http_lua_ffi_ssl_validate_ocsp_response in ngx_http_lua_sslcertby.o
  "_sk_value", referenced from:
      _ngx_ssl_session_cache in ngx_event_openssl.o
      _ngx_ssl_stapling in ngx_event_openssl_stapling.o
      _ngx_http_lua_ffi_ssl_get_ocsp_responder_from_der_chain in ngx_http_lua_sslcertby.o
ld: symbol(s) not found for architecture x86_64
clang: error: linker command failed with exit code 1 (use -v to see invocation)
make[2]: *** [objs/nginx] Error 1
make[1]: *** [build] Error 2
make: *** [all] Error 2

I have created this script to automate the installing process, and seems to be working fine on CentOS: https://gist.github.com/thefosk/521d6342bf5850bf8f41

[subnetmarco]

The error might be caused because when running make I get the following warning:

Operating system: i686-apple-darwinDarwin Kernel Version 14.3.0: Mon Mar 23 11:59:05 PDT 2015; root:xnu-2782.20.48~5/RELEASE_X86_64
WARNING! If you wish to build 64-bit library, then you have to
         invoke './Configure darwin64-x86_64-cc' *manually*.
         You have about 5 seconds to press Ctrl-C to abort.

The make command invokes the following call:

cd /tmp/ngx_openresty-1.7.10.2rc0/build/nginx-1.7.10 && /Applications/Xcode.app/Contents/Developer/usr/bin/make
/Applications/Xcode.app/Contents/Developer/usr/bin/make -f objs/Makefile
cd /tmp/openssl-1.0.2a \
    && if [ -f Makefile ]; then /Applications/Xcode.app/Contents/Developer/usr/bin/make clean; fi \
    && ./config --prefix=/tmp/openssl-1.0.2a/.openssl no-shared  no-threads \
    && /Applications/Xcode.app/Contents/Developer/usr/bin/make \
    && /Applications/Xcode.app/Contents/Developer/usr/bin/make install LIBDIR=lib

while on OS X ./config should probably be ./Configure darwin64-x86_64-cc. That is because I am specifying the OpenSSL folder with --with-openssl instead of having it already installed in the system.

It's probably an edge case. Feel free to close the issue if you think this is negligible.

[subnetmarco]

Actually even when install OpenSSL properly, and running make on OS X again I get the following error:

-L/private/tmp/ngx_openresty-1.7.10.2rc0/build/luajit-root/usr/local/openresty/luajit/lib -Wl,-rpath,/usr/local/openresty/luajit/lib -L/usr/local/lib -L/private/tmp/ngx_openresty-1.7.10.2rc0/build/luajit-root/usr/local/openresty/luajit/lib -lluajit-5.1 -lm -pagezero_size 10000 -image_base 100000000 -lpcre -lssl -lcrypto -lz
Undefined symbols for architecture x86_64:
  "_SSL_CTX_set_alpn_select_cb", referenced from:
      _ngx_http_ssl_merge_srv_conf in ngx_http_ssl_module.o
  "_SSL_CTX_set_cert_cb", referenced from:
      _ngx_http_lua_merge_srv_conf in ngx_http_lua_module.o
  "_SSL_CTX_set_next_protos_advertised_cb", referenced from:
      _ngx_http_ssl_merge_srv_conf in ngx_http_ssl_module.o
  "_SSL_certs_clear", referenced from:
      _ngx_http_lua_ffi_ssl_clear_certs in ngx_http_lua_sslcertby.o
  "_SSL_select_next_proto", referenced from:
      _ngx_http_ssl_alpn_select in ngx_http_ssl_module.o
  "_X509_check_host", referenced from:
      _ngx_ssl_check_host in ngx_event_openssl.o
ld: symbol(s) not found for architecture x86_64
clang: error: linker command failed with exit code 1 (use -v to see invocation)
make[2]: *** [objs/nginx] Error 1
make[1]: *** [build] Error 2
make: *** [all] Error 2

OpenSSL is 1.0.2a:

$ openssl version
OpenSSL 1.0.2a 19 Mar 2015

[subnetmarco]

This was a problem with OpenSSL, make wasn't picking the right files.

I fixed this issue by adding export KERNEL_BITS=64 before running make, so that make would properly compile for OS X using ./config instead of ./Configure. I have also updated the script: https://gist.github.com/thefosk/521d6342bf5850bf8f41

[agentzh]

@Ansar1628 Please do not cross-post. It's annoying. I've replied to you here:

#842 (comment)