Nginx 1.21.1 source build with static openssl fails on Freebsd12

[wakwanza@…]

Trying to build from source with openssl 1.1.1k fails in the linking stage.Building the openssl separately passes and nginx compilation without the --with-openssl directive builds successfully.

Configure options as follows, some extra modules and openssl-1.1.1k:

./configure --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --conf-path=/usr/local/etc/nginx/nginx.conf  --pid-path=/var/run/nginx/nginx.pid --lock-path=/var/run/nginx.lock  --user=nginx --group=nginx --with-threads  --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module --with-http_image_filter_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_auth_request_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module --with-stream --with-openssl=/data/src/openssl-1.1.1k --with-openssl-opt="no-tests no-ssl2 no-ssl3 no-shared no-weak-ssl-ciphers" --with-stream_ssl_module --with-stream_realip_module --with-stream_ssl_preread_module --with-http_ssl_module --add-module=/data/ngx/ngx_devel_kit --add-module=/data/ngx/headers-more-nginx-module --with-cc-opt="-I ${LOCALBASE}/include" --with-ld-opt="-L ${LOCALBASE}/lib -Wl,-u,static" --with-compat

on running make , fails with this output:

cc -c -pipe  -O -Wall -Wextra -Wpointer-arith -Wconditional-uninitialized -Wno-unused-parameter -Werror -g -I /include -I src/core  -I src/event  -I src/event/modules  -I src/os/unix  -I /data/ngx/ngx_devel_kit/objs  -I objs/addon/ndk  -I /usr/local/include  -I /data/src/openssl-1.1.1k/.openssl/include  -I /usr/local/include/libxml2  -I /usr/local/include  -I /usr/local/include  -I objs  -o objs/ngx_modules.o  objs/ngx_modules.c
cc -o objs/nginx  objs/src/core/nginx.o  objs/src/core/ngx_log.o  objs/src/core/ngx_palloc.o  objs/src/core/ngx_array.o  objs/src/core/ngx_list.o  objs/src/core/ngx_hash.o  objs/src/core/ngx_buf.o  objs/src/core/ngx_queue.o  objs/src/core/ngx_output_chain.o  objs/src/core/ngx_string.o  objs/src/core/ngx_parse.o  objs/src/core/ngx_parse_time.o  objs/src/core/ngx_inet.o  objs/src/core/ngx_file.o  objs/src/core/ngx_crc32.o  objs/src/core/ngx_murmurhash.o  objs/src/core/ngx_md5.o  objs/src/core/ngx_sha1.o  objs/src/core/ngx_rbtree.o  objs/src/core/ngx_radix_tree.o  objs/src/core/ngx_slab.o  objs/src/core/ngx_times.o  objs/src/core/ngx_shmtx.o  objs/src/core/ngx_connection.o  objs/src/core/ngx_cycle.o  objs/src/core/ngx_spinlock.o  objs/src/core/ngx_rwlock.o  objs/src/core/ngx_cpuinfo.o  objs/src/core/ngx_conf_file.o  objs/src/core/ngx_module.o  objs/src/core/ngx_resolver.o  objs/src/core/ngx_open_file_cache.o  objs/src/core/ngx_crypt.o  objs/src/core/ngx_proxy_protocol.o  objs/src/core/ngx_syslog.o  objs/src/event/ngx_event.o  objs/src/event/ngx_event_timer.o  objs/src/event/ngx_event_posted.o  objs/src/event/ngx_event_accept.o  objs/src/event/ngx_event_udp.o  objs/src/event/ngx_event_connect.o  objs/src/event/ngx_event_pipe.o  objs/src/os/unix/ngx_time.o  objs/src/os/unix/ngx_errno.o  objs/src/os/unix/ngx_alloc.o  objs/src/os/unix/ngx_files.o  objs/src/os/unix/ngx_socket.o  objs/src/os/unix/ngx_recv.o  objs/src/os/unix/ngx_readv_chain.o  objs/src/os/unix/ngx_udp_recv.o  objs/src/os/unix/ngx_send.o  objs/src/os/unix/ngx_writev_chain.o  objs/src/os/unix/ngx_udp_send.o  objs/src/os/unix/ngx_udp_sendmsg_chain.o  objs/src/os/unix/ngx_channel.o  objs/src/os/unix/ngx_shmem.o  objs/src/os/unix/ngx_process.o  objs/src/os/unix/ngx_daemon.o  objs/src/os/unix/ngx_setaffinity.o  objs/src/os/unix/ngx_setproctitle.o  objs/src/os/unix/ngx_posix_init.o  objs/src/os/unix/ngx_user.o  objs/src/os/unix/ngx_dlopen.o  objs/src/os/unix/ngx_process_cycle.o  objs/src/os/unix/ngx_freebsd_init.o  objs/src/os/unix/ngx_freebsd_sendfile_chain.o  objs/src/event/modules/ngx_kqueue_module.o  objs/src/core/ngx_thread_pool.o  objs/src/os/unix/ngx_thread_cond.o  objs/src/os/unix/ngx_thread_mutex.o  objs/src/os/unix/ngx_thread_id.o  objs/src/event/ngx_event_openssl.o  objs/src/event/ngx_event_openssl_stapling.o  objs/src/core/ngx_regex.o  objs/src/http/ngx_http.o  objs/src/http/ngx_http_core_module.o  objs/src/http/ngx_http_special_response.o  objs/src/http/ngx_http_request.o  objs/src/http/ngx_http_parse.o  objs/src/http/modules/ngx_http_log_module.o  objs/src/http/ngx_http_request_body.o  objs/src/http/ngx_http_variables.o  objs/src/http/ngx_http_script.o  objs/src/http/ngx_http_upstream.o  objs/src/http/ngx_http_upstream_round_robin.o  objs/src/http/ngx_http_file_cache.o  objs/src/http/ngx_http_write_filter_module.o  objs/src/http/ngx_http_header_filter_module.o  objs/src/http/modules/ngx_http_chunked_filter_module.o  objs/src/http/v2/ngx_http_v2_filter_module.o  objs/src/http/modules/ngx_http_range_filter_module.o  objs/src/http/modules/ngx_http_gzip_filter_module.o  objs/src/http/ngx_http_postpone_filter_module.o  objs/src/http/modules/ngx_http_ssi_filter_module.o  objs/src/http/modules/ngx_http_charset_filter_module.o  objs/src/http/modules/ngx_http_xslt_filter_module.o  objs/src/http/modules/ngx_http_image_filter_module.o  objs/src/http/modules/ngx_http_sub_filter_module.o  objs/src/http/modules/ngx_http_addition_filter_module.o  objs/src/http/modules/ngx_http_gunzip_filter_module.o  objs/src/http/modules/ngx_http_userid_filter_module.o  objs/src/http/modules/ngx_http_headers_filter_module.o  objs/src/http/ngx_http_copy_filter_module.o  objs/src/http/modules/ngx_http_not_modified_filter_module.o  objs/src/http/modules/ngx_http_slice_filter_module.o  objs/src/http/v2/ngx_http_v2.o  objs/src/http/v2/ngx_http_v2_table.o  objs/src/http/v2/ngx_http_v2_encode.o  objs/src/http/v2/ngx_http_v2_huff_decode.o  objs/src/http/v2/ngx_http_v2_huff_encode.o  objs/src/http/v2/ngx_http_v2_module.o  objs/src/http/modules/ngx_http_static_module.o  objs/src/http/modules/ngx_http_gzip_static_module.o  objs/src/http/modules/ngx_http_dav_module.o  objs/src/http/modules/ngx_http_autoindex_module.o  objs/src/http/modules/ngx_http_index_module.o  objs/src/http/modules/ngx_http_random_index_module.o  objs/src/http/modules/ngx_http_mirror_module.o  objs/src/http/modules/ngx_http_try_files_module.o  objs/src/http/modules/ngx_http_auth_request_module.o  objs/src/http/modules/ngx_http_auth_basic_module.o  objs/src/http/modules/ngx_http_access_module.o  objs/src/http/modules/ngx_http_limit_conn_module.o  objs/src/http/modules/ngx_http_limit_req_module.o  objs/src/http/modules/ngx_http_realip_module.o  objs/src/http/modules/ngx_http_geo_module.o  objs/src/http/modules/ngx_http_map_module.o  objs/src/http/modules/ngx_http_split_clients_module.o  objs/src/http/modules/ngx_http_referer_module.o  objs/src/http/modules/ngx_http_rewrite_module.o  objs/src/http/modules/ngx_http_ssl_module.o  objs/src/http/modules/ngx_http_proxy_module.o  objs/src/http/modules/ngx_http_fastcgi_module.o  objs/src/http/modules/ngx_http_uwsgi_module.o  objs/src/http/modules/ngx_http_scgi_module.o  objs/src/http/modules/ngx_http_grpc_module.o  objs/src/http/modules/perl/ngx_http_perl_module.o  objs/src/http/modules/ngx_http_memcached_module.o  objs/src/http/modules/ngx_http_empty_gif_module.o  objs/src/http/modules/ngx_http_browser_module.o  objs/src/http/modules/ngx_http_secure_link_module.o  objs/src/http/modules/ngx_http_degradation_module.o  objs/src/http/modules/ngx_http_flv_module.o  objs/src/http/modules/ngx_http_mp4_module.o  objs/src/http/modules/ngx_http_upstream_hash_module.o  objs/src/http/modules/ngx_http_upstream_ip_hash_module.o  objs/src/http/modules/ngx_http_upstream_least_conn_module.o  objs/src/http/modules/ngx_http_upstream_random_module.o  objs/src/http/modules/ngx_http_upstream_keepalive_module.o  objs/src/http/modules/ngx_http_upstream_zone_module.o  objs/src/http/modules/ngx_http_stub_status_module.o  objs/src/stream/ngx_stream.o  objs/src/stream/ngx_stream_variables.o  objs/src/stream/ngx_stream_script.o  objs/src/stream/ngx_stream_handler.o  objs/src/stream/ngx_stream_core_module.o  objs/src/stream/ngx_stream_log_module.o  objs/src/stream/ngx_stream_proxy_module.o  objs/src/stream/ngx_stream_upstream.o  objs/src/stream/ngx_stream_upstream_round_robin.o  objs/src/stream/ngx_stream_write_filter_module.o  objs/src/stream/ngx_stream_ssl_module.o  objs/src/stream/ngx_stream_realip_module.o  objs/src/stream/ngx_stream_limit_conn_module.o  objs/src/stream/ngx_stream_access_module.o  objs/src/stream/ngx_stream_geo_module.o  objs/src/stream/ngx_stream_map_module.o  objs/src/stream/ngx_stream_split_clients_module.o  objs/src/stream/ngx_stream_return_module.o  objs/src/stream/ngx_stream_set_module.o  objs/src/stream/ngx_stream_upstream_hash_module.o  objs/src/stream/ngx_stream_upstream_least_conn_module.o  objs/src/stream/ngx_stream_upstream_random_module.o  objs/src/stream/ngx_stream_upstream_zone_module.o  objs/src/stream/ngx_stream_ssl_preread_module.o  objs/addon/src/ndk.o  objs/addon/src/ngx_http_headers_more_filter_module.o  objs/addon/src/ngx_http_headers_more_headers_out.o  objs/addon/src/ngx_http_headers_more_headers_in.o  objs/addon/src/ngx_http_headers_more_util.o  objs/ngx_modules.o  -L /lib -Wl,-u,static -lpthread -lcrypt -L/usr/local/lib -lpcre /data/src/openssl-1.1.1k/.openssl/lib/libssl.a /data/src/openssl-1.1.1k/.openssl/lib/libcrypto.a -lpthread -lz -L/usr/local/lib -lxml2 -lxslt -lexslt -L/usr/local/lib -lgd  -Wl,-R/usr/local/lib/perl5/5.32/mach/CORE -pthread -Wl,-E -fstack-protector-strong -L/usr/local/lib -L/usr/local/lib/perl5/5.32/mach/CORE -lperl -lpthread -lm -lcrypt -lutil  -Wl,-E
ld: error: undefined symbol: SSL_get_ex_new_index
>>> referenced by ngx_event_openssl.c:186 (src/event/ngx_event_openssl.c:186)
>>>               objs/src/event/ngx_event_openssl.o:(ngx_ssl_init)

ld: error: undefined symbol: SSL_CTX_get_ex_new_index
>>> referenced by ngx_event_openssl.c:193 (src/event/ngx_event_openssl.c:193)
>>>               objs/src/event/ngx_event_openssl.o:(ngx_ssl_init)
>>> referenced by ngx_event_openssl.c:201 (src/event/ngx_event_openssl.c:201)
>>>               objs/src/event/ngx_event_openssl.o:(ngx_ssl_init)
>>> referenced by ngx_event_openssl.c:209 (src/event/ngx_event_openssl.c:209)
>>>               objs/src/event/ngx_event_openssl.o:(ngx_ssl_init)
>>> referenced by ngx_event_openssl.c:217 (src/event/ngx_event_openssl.c:217)
>>>               objs/src/event/ngx_event_openssl.o:(ngx_ssl_init)
>>> referenced by ngx_event_openssl.c:224 (src/event/ngx_event_openssl.c:224)
>>>               objs/src/event/ngx_event_openssl.o:(ngx_ssl_init)

ld: error: undefined symbol: X509_get_ex_new_index
>>> referenced by ngx_event_openssl.c:232 (src/event/ngx_event_openssl.c:232)
>>>               objs/src/event/ngx_event_openssl.o:(ngx_ssl_init)
>>> referenced by ngx_event_openssl.c:239 (src/event/ngx_event_openssl.c:239)
>>>               objs/src/event/ngx_event_openssl.o:(ngx_ssl_init)
>>> referenced by ngx_event_openssl.c:247 (src/event/ngx_event_openssl.c:247)
>>>               objs/src/event/ngx_event_openssl.o:(ngx_ssl_init)

ld: error: undefined symbol: SSLv23_method
>>> referenced by ngx_event_openssl.c:261 (src/event/ngx_event_openssl.c:261)
>>>               objs/src/event/ngx_event_openssl.o:(ngx_ssl_create)

ld: error: undefined symbol: SSL_CTX_set_min_proto_version
>>> referenced by ngx_event_openssl.c:360 (src/event/ngx_event_openssl.c:360)
>>>               objs/src/event/ngx_event_openssl.o:(ngx_ssl_create)

ld: error: undefined symbol: SSL_CTX_set_max_proto_version
>>> referenced by ngx_event_openssl.c:361 (src/event/ngx_event_openssl.c:361)
>>>               objs/src/event/ngx_event_openssl.o:(ngx_ssl_create)

ld: error: undefined symbol: SSL_CTX_set0_chain
>>> referenced by ngx_event_openssl.c:486 (src/event/ngx_event_openssl.c:486)
>>>               objs/src/event/ngx_event_openssl.o:(ngx_ssl_certificate)

ld: error: undefined symbol: sk_pop_free
>>> referenced by ngx_event_openssl.c:0 (src/event/ngx_event_openssl.c:0)
>>>               objs/src/event/ngx_event_openssl.o:(ngx_ssl_certificate)
>>> referenced by ngx_event_openssl.c:0 (src/event/ngx_event_openssl.c:0)
>>>               objs/src/event/ngx_event_openssl.o:(ngx_ssl_load_certificate)
>>> referenced by ngx_event_openssl.c:0 (src/event/ngx_event_openssl.c:0)
>>>               objs/src/event/ngx_event_openssl.o:(ngx_ssl_connection_certificate)
>>> referenced by ngx_event_openssl_stapling.c:1256 (src/event/ngx_event_openssl_stapling.c:1256)
>>>               objs/src/event/ngx_event_openssl_stapling.o:(ngx_ssl_ocsp_cleanup)

ld: error: undefined symbol: sk_new_null
>>> referenced by ngx_event_openssl.c:656 (src/event/ngx_event_openssl.c:656)
>>>               objs/src/event/ngx_event_openssl.o:(ngx_ssl_load_certificate)

ld: error: undefined symbol: sk_push
>>> referenced by ngx_event_openssl.c:687 (src/event/ngx_event_openssl.c:687)
>>>               objs/src/event/ngx_event_openssl.o:(ngx_ssl_load_certificate)

ld: error: undefined symbol: SSL_set0_chain
>>> referenced by ngx_event_openssl.c:579 (src/event/ngx_event_openssl.c:579)
>>>               objs/src/event/ngx_event_openssl.o:(ngx_ssl_connection_certificate)

ld: error: undefined symbol: SSL_CTX_set1_groups_list
>>> referenced by ngx_event_openssl.c:1425 (src/event/ngx_event_openssl.c:1425)
>>>               objs/src/event/ngx_event_openssl.o:(ngx_ssl_ecdh_curve)

ld: error: undefined symbol: SSL_state
>>> referenced by ngx_event_openssl.c:2907 (src/event/ngx_event_openssl.c:2907)
>>>               objs/src/event/ngx_event_openssl.o:(ngx_ssl_shutdown)

ld: error: undefined symbol: EVP_MD_CTX_create
>>> referenced by ngx_event_openssl.c:3369 (src/event/ngx_event_openssl.c:3369)
>>>               objs/src/event/ngx_event_openssl.o:(ngx_ssl_session_cache)

ld: error: undefined symbol: sk_num
>>> referenced by ngx_event_openssl.c:3425 (src/event/ngx_event_openssl.c:3425)
>>>               objs/src/event/ngx_event_openssl.o:(ngx_ssl_session_cache)
>>> referenced by ngx_event_openssl_stapling.c:374 (src/event/ngx_event_openssl_stapling.c:374)
>>>               objs/src/event/ngx_event_openssl_stapling.o:(ngx_ssl_stapling)
>>> referenced by ngx_event_openssl_stapling.c:985 (src/event/ngx_event_openssl_stapling.c:985)
>>>               objs/src/event/ngx_event_openssl_stapling.o:(ngx_ssl_ocsp_validate_next)

ld: error: undefined symbol: sk_value
>>> referenced by ngx_event_openssl.c:3428 (src/event/ngx_event_openssl.c:3428)
>>>               objs/src/event/ngx_event_openssl.o:(ngx_ssl_session_cache)
>>> referenced by ngx_event_openssl_stapling.c:380 (src/event/ngx_event_openssl_stapling.c:380)
>>>               objs/src/event/ngx_event_openssl_stapling.o:(ngx_ssl_stapling)
>>> referenced by ngx_event_openssl_stapling.c:470 (src/event/ngx_event_openssl_stapling.c:470)
>>>               objs/src/event/ngx_event_openssl_stapling.o:(ngx_ssl_stapling)
>>> referenced by ngx_event_openssl_stapling.c:1008 (src/event/ngx_event_openssl_stapling.c:1008)
>>>               objs/src/event/ngx_event_openssl_stapling.o:(ngx_ssl_ocsp_validate_next)
>>> referenced by ngx_event_openssl_stapling.c:1009 (src/event/ngx_event_openssl_stapling.c:1009)
>>>               objs/src/event/ngx_event_openssl_stapling.o:(ngx_ssl_ocsp_validate_next)
>>> referenced by ngx_event_openssl_stapling.c:1141 (src/event/ngx_event_openssl_stapling.c:1141)
>>>               objs/src/event/ngx_event_openssl_stapling.o:(ngx_ssl_ocsp_validate_next)

ld: error: undefined symbol: EVP_MD_CTX_destroy
>>> referenced by ngx_event_openssl.c:3450 (src/event/ngx_event_openssl.c:3450)
>>>               objs/src/event/ngx_event_openssl.o:(ngx_ssl_session_cache)
>>> referenced by ngx_event_openssl.c:3462 (src/event/ngx_event_openssl.c:3462)
>>>               objs/src/event/ngx_event_openssl.o:(ngx_ssl_session_cache)

ld: error: undefined symbol: d2i_OCSP_RESPONSE_bio
>>> referenced by ngx_event_openssl_stapling.c:316 (src/event/ngx_event_openssl_stapling.c:316)
>>>               objs/src/event/ngx_event_openssl_stapling.o:(ngx_ssl_stapling)
cc: error: linker command failed with exit code 1 (use -v to see invocation)
*** Error code 1

Stop.
make[1]: stopped in /data/src/nginx-1.21.1
*** Error code 1

Stop.
make: stopped in /data/src/nginx-1.21.1

[Maxim Dounin]

The error messages suggest there is a conflicting SSL library, likely LibreSSL or BoringSSL, installed on the system, likely in -I /include or in -I /usr/local/include, and its include files are used instead of the ones from the library being compiled by nginx since relevant -I options are specified first.

Removing the conflicting library from the paths used during compilation should fix things. Alternatively, consider explicitly specifying most-specific include / library paths first in the --with-cc-opt / --with-ld-opt configure arguments.

See also #1781.