![[PukiWiki]](image/pukiwiki.png "[PukiWiki]")
CONTENTS
Lastmodified 2023-11-30 (木) 10:07:26
FreeBSD Base system の OpenSSLを使用している py-certbot は、certbot renew 出来るのに、
/etc/make.conf
NO_SENDMAIL= true DEFAULT_VERSIONS+= perl5=5.34 # DEFAULT_VERSIONS+=ruby=2.7 DEFAULT_VERSIONS+=ssl=openssl ← これ OPTIONS_UNSET+=X11 #FORCE_PKG_REGISTER=yes #OPTIONS_UNSET+=GUI DEFAULT_VERSIONS+= bdb=18 WITH_BDB6_PERMITTED=yes
の様に、ports でインストールしたOpenSSLで、certbot renew しようとするとエラーになる。
# /root/bin/Certbot_Renew.sh
Traceback (most recent call last):
File "/usr/local/bin/certbot", line 33, in <module>
sys.exit(load_entry_point('certbot==2.7.4', 'console_scripts', 'certbot')())
File "/usr/local/bin/certbot", line 25, in importlib_load_entry_point
return next(matches).load()
File "/usr/local/lib/python3.9/importlib/metadata.py", line 86, in load
module = import_module(match.group('module'))
File "/usr/local/lib/python3.9/importlib/__init__.py", line 127, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
File "<frozen importlib._bootstrap>", line 1030, in _gcd_import
File "<frozen importlib._bootstrap>", line 1007, in _find_and_load
File "<frozen importlib._bootstrap>", line 986, in _find_and_load_unlocked
File "<frozen importlib._bootstrap>", line 680, in _load_unlocked
File "<frozen importlib._bootstrap_external>", line 850, in exec_module
File "<frozen importlib._bootstrap>", line 228, in _call_with_frames_removed
File "/usr/local/lib/python3.9/site-packages/certbot/main.py", line 6, in <module>
from certbot._internal import main as internal_main
File "/usr/local/lib/python3.9/site-packages/certbot/_internal/main.py", line 21, in <module>
import josepy as jose
File "/usr/local/lib/python3.9/site-packages/josepy/__init__.py", line 40, in <module>
from josepy.json_util import (
File "/usr/local/lib/python3.9/site-packages/josepy/json_util.py", line 14, in <module>
from OpenSSL import crypto
File "/usr/local/lib/python3.9/site-packages/OpenSSL/__init__.py", line 8, in <module>
from OpenSSL import SSL, crypto
File "/usr/local/lib/python3.9/site-packages/OpenSSL/SSL.py", line 9, in <module>
from OpenSSL._util import (
File "/usr/local/lib/python3.9/site-packages/OpenSSL/_util.py", line 6, in <module>
from cryptography.hazmat.bindings.openssl.binding import Binding
File "/usr/local/lib/python3.9/site-packages/cryptography/hazmat/bindings/openssl/binding.py", line 15, in <module>
from cryptography.exceptions import InternalError
File "/usr/local/lib/python3.9/site-packages/cryptography/exceptions.py", line 9, in <module>
from cryptography.hazmat.bindings._rust import exceptions as rust_exceptions
ImportError: /usr/local/lib/python3.9/site-packages/cryptography/hazmat/bindings/_rust.abi3.so: Undefined symbol "EVP_default_properties_is_fips_enabled"
root@blackcube:~:23_11_28:9:07 #
同じようなエラーが、https://freebsd.sing.ne.jp/daily/13/14.html に記載されていた。
こちらの記事では、cryptography をPIPインストールして最新版にすることでエラー回避出来た様だ。が、最終手段としてφ(.. )メモ
エラー内様で "EVP_default_properties_is_fips_enabled" とあるので、FIPSのチェックを外して make しただけでは、エラー回避出来なかったと https://community.letsencrypt.org/t/did-openssl-3-0-break-certbot/207661/21 に記載があるので、LEGACY にチェックをいれてみる、と・・・
FIPS のチェックを外し、LEGACY のチェックを入れる。
cd /usr/ports/security/openssl make deinstall make install clean
エラー回避出来た！
# /root/bin/Certbot_Renew.sh Saving debug log to /var/log/letsencrypt/letsencrypt.log - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Processing /usr/local/etc/letsencrypt/renewal/blackhole.smb.net.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Hook 'pre-hook' ran with output: Stopping apache24. Waiting for PIDS: 29144. Renewing an existing certificate for blackhole.smb.net - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Congratulations, all renewals succeeded: /usr/local/etc/letsencrypt/live/blackhole.smb.net/fullchain.pem (success) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Hook 'post-hook' ran with output: Performing sanity check on apache24 configuration: Starting apache24. Hook 'post-hook' ran with error output: Syntax OK
# cd /usr/ports/security/openssl
make deinstall
/etc/make.conf
DEFAULT_VERSIONS+=ssl=openssl ← コメントアウトする
reboot
あれこれ試すも、エラー回避出来たのが、
# portupgrade -rfR py39-certbot-2.7.4,1 --batch
NG!
# portupgrade -rfR py39-cryptography --batch
で、エラー回避できた。OK
PIPを用いる方法。別ページに記載
Total access 263：本日 2：昨日 1
OpenSSL_config.PNG