Skip to content

OpenSSL fix for x509 OpenSSL 4 and 3 - #8535

Merged
danoli3 merged 17 commits into
openframeworks:masterfrom
danoli3:openssl-hotfix
Aug 13, 2026
Merged

OpenSSL fix for x509 OpenSSL 4 and 3#8535
danoli3 merged 17 commits into
openframeworks:masterfrom
danoli3:openssl-hotfix

Conversation

@danoli3

@danoli3 danoli3 commented Aug 11, 2026

Copy link
Copy Markdown
Member

No description provided.

@danoli3

danoli3 commented Aug 13, 2026

Copy link
Copy Markdown
Member Author
-DOPENSSL_NO_ASM=ON          # global - disables all asm (incl. RDRAND/CHACHA/KECCAK)                                         

On darwin/arm64 OpenSSL 4.0.1 the DRBG (CTR-DRBG/HASH-DRBG) provider needs RDRAND fallback via asm - with
NO_ASM=ON the default provider builds but ossl_drbg_... can't fetch at runtime:

error:12000090:random number generator::unable to fetch drbg                                            
=> * Insufficient randomness * closing connection #1 (443)                                              

Your libs/openssl.xcframework 18M 4.0.1 was built that way (configuration.h: OPENSSL_NO_ASM,
OPENSSL_RAND_SEED_OS still os but DRBG never instantiates). 3.4 worked because RAND was not yet
provider-based.

@danoli3

danoli3 commented Aug 13, 2026

Copy link
Copy Markdown
Member Author
notice ] load from fs passed
[ notice ] load from fs passed
* Host openframeworks.cc:80 was resolved.
* IPv6: (none)
* IPv4: [REDACTED]
*   Trying [REDACTED]:80...
* Established connection to openframeworks.cc ([REDACTED] port 80) from [REDACTED] port 49215 
* using HTTP/1.x
> GET /about/0.jpg HTTP/1.1
Host: openframeworks.cc
User-Agent: curl/8.21.0
Accept: */*
Accept-Encoding: deflate, gzip, br
Connection: close

* Request completely sent off
< HTTP/1.1 301 Moved Permanently
< Server: nginx
< Date: Thu, 13 Aug 2026 15:42:28 GMT
< Content-Type: text/html
< Content-Length: 162
< Connection: close
< Location: https://openframeworks.cc/about/0.jpg
< 
* shutting down connection #0
* Issue another request to this URL: 'https://openframeworks.cc/about/0.jpg'
* Host openframeworks.cc:443 was resolved.
* IPv6: (none)
* IPv4: [REDACTED]
*   Trying [REDACTED]:443...
* ALPN: curl offers h2,http/1.1
* SSL Trust Anchors:
*   Native: Apple SecTrust
*   OpenSSL default paths (fallback)
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey
* ALPN: server accepted http/1.1
* Server certificate:
*   subject: CN=openframeworks.cc
*   start date: Aug  2 11:52:00 2026 GMT
*   expire date: Oct 31 11:51:59 2026 GMT
*   issuer: C=US; O=Let's Encrypt; CN=YE2
*   Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA384
*   Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
*   Certificate level 2: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
*   Certificate level 3: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using sha256WithRSAEncryption
*   subjectAltName: "openframeworks.cc" matches cert's "openframeworks.cc"
* OpenSSL verify result: 14
* SSL certificate verified via Apple SecTrust.
* Established connection to openframeworks.cc ([REDACTED] port 443) from [REDACTED] port 49216 
* using HTTP/1.x
> GET /about/0.jpg HTTP/1.1
Host: openframeworks.cc
User-Agent: curl/8.21.0
Accept: */*
Accept-Encoding: deflate, gzip, br
Connection: close

* Request completely sent off
< HTTP/1.1 200 OK
< Server: nginx
< Date: Thu, 13 Aug 2026 15:42:28 GMT
[ notice ] http resp status=200 error='' data.size=28629
< Content-Type: image/jpeg
[ notice ] load from http passed
< Content-Length: 28629
< Last-Modified: Tue, 03 Feb 2026 02:56:04 GMT
< Connection: close
< ETag: "698163c4-6fd5"
< Expires: Fri, 13 Aug 2027 15:42:28 GMT
< Cache-Control: max-age=31536000
< Cache-Control: public, immutable
[ notice ] https resp status=200 error='' data.size=34757
< Accept-Ranges: bytes
[ notice ] load from https passed
< 
[ notice ] 4/4 tests passed
* shutting down connection #1
[ notice ] took 466ms
* Host avatars.githubusercontent.com:443 was resolved.
* IPv6: (none)
math
types
utils

working with Random entropy added without ASM...

@danoli3 danoli3 left a comment

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice

@danoli3
danoli3 merged commit 3563008 into openframeworks:master Aug 13, 2026
20 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant