This is an old revision of the document!
LibreSSL is a fork of OpenSSL created by OpenBSD. There is also a portable version which is available in the ports tree: security/libressl.
LibreSSL has removed a number of OpenSSL features which can result in build issues for software that relies on them.
LibreSSL also has functionality that is not available in other ssl libraries on FreeBSD
- ChaCha20/Poly1305 cipher
Much of the detail in the original article has now been split into multiple sub-pages
How to use LibreSSL
LibreSSL versions
The OpenBSD project has multiple branches of LibreSSL. This chapter describes how the upstream project and the FreeBSD ports correlate.
The ports are currently being refactored to reflect what's in this chapter
Stable
Not to be confused with FreeBSD's -STABLE
The stable versions correspond to a version of OpenBSD (planned versions/dates in parentheses)
| LibreSSL version | OpenBSD version | Branched | Release | End-of-support |
| 2.0.(5) | 5.6 | 2014-07-12 | 2014-11-01 | 2015-11-01 |
| 2.1.(5) | 5.7 | 2014-10-13 | 2015-05-01 | 2016-05-01 |
| 2.2.(2) | (5.8) | 2015-06-11 | (2015-11-01) | (2016-11-01) |
| 2.3.x | (5.9) | 2015-09-23 | (2016-05-01) | (2017-05-01) |
OpenBSD releases happen every 6 months and the project will provide updates for stable versions for one year after release of the corresponding OpenBSD version. With the release of the next OpenBSD version, the ABI will remain stable and the major shared library versions do not change.
Next
These are point versions for the next OpenBSD release. Up to the release of the corresponding OpenBSD version, the ABI and major shared library version keep changing. The snapshot version contains features that are not found in the stable version. To use the latest LibreSSL features, this is the branch to follow.
The snapshots are considered to be secure just like the stable versions
In ports
To stay in line with the upstream OpenBSD project, the ports tree will (as of version 2.2/2.3) contain the stable version and the next/snapshot version for early adopters.
| Date | stable | devel |
| 2015-11-01 | 2.2 | 2.3 |
| 2016-05-01 | 2.3 | 2.4 |
As OpenBSD releases their next version of LibreSSL-Portable, the libressl-devel port will link to that next-stable version and you must rebuild all your ports.
Binary distribution
The standard packages from FreeBSD are still being built with OpenSSL from base and for some packages requiring a newer OpenSSL with OpenSSL from ports.
The following FreeBSD derivatives are known to use LibreSSL
Using LibreSSL with ports
To build ports against LibreSSL, add the following lines to /etc/make.conf
# Build ports against security/libressl WITH_OPENSSL_PORT= yes OPENSSL_PORT= security/libressl
Most ports will build without issue, some need fixing. See following paragraphs for the most notable.
If you require the latest features LibreSSL provides or wish to use the previous stable version, use the following in /etc/make.conf
WITH_OPENSSL_PORT= yes # Use the latest release with frequently changing API OPENSSL_PORT= security/libressl-devel
cURL
After switching this will most likely hit you.
- GSS-API: If you need this you must select one of the ports implementations, you cannot combine ports Open-/LibreSSL with base GSS-API
- Secure Remote Password (TLS-SRP): Must be disabled
Python
As of python27-2.7.10 and python34-3.4.3 Python has included fixes for LibreSSL.
Python 3.2 and 3.3 have not been fixed yet but you can find patches in this section
Using LibreSSL with base/world
Currently there's no solution available to create a FreeBSD installation where LibreSSL replaces the default OpenSSL libraries. Work is undergoing to see if this is viable.
Known problems/quirks
security/p5-openxpi: Claimed to not be fully functional by the developers
security/py-cryptography: Claimed to not be fully functional by the developers
Building world
When you build world when you have LibreSSL installed, some base utilities will link to LibreSSL. These you will have to update every time there are shared library versions are bumped
History
| Version | Release | days | libssl/crypto/tls |
| LibreSSL 2.0 branch (OpenBSD 5.6) | |||
| 2.0.0 | 12 Jul 2014 | 1 | 27/30/- |
| 2.0.1 | 13 Jul 2014 | 3 | 27/30/- |
| 2.0.2 | 16 Jul 2014 | 6 | 27/30/- |
| 2.0.3 | 22 Jul 2014 | 12 | 27/30/- |
| 2.0.4 | 03 Aug 2014 | 14 | 27/30/- |
| 2.0.5 | 17 Aug 2014 | 57 | 27/30/- |
| LibreSSL 2.1 (OpenBSD 5.7) | |||
| 2.1.0 | 13 Oct 2014 | 4 | 27/30/- |
| 2.1.1 | 17 Oct 2014 | 60 | 29/30/- |
| 2.1.2 | 16 Dec 2014 | 37 | 29/30/- |
| 2.1.3 | 22 Jan 2015 | 40 | 30/30/- |
| 2.1.4 | 04 Mar 2015 | 41 | 32/32/- |
| 2.1.5 | 17 Mar 2015 | 13 | 32/32/3 |
| 2.1.6 | 19 Mar 2015 | 2 | 32/32/3 |
| 2.1.7 | 11 Jun 2015 | 84 | 32/32/3 |
| 2.1.8 | 15 Oct 2015 | 126 | 32/32/3 |
| 2.1.9 | 08 Dec 2015 | 54 | 32/32/3 |
| LibreSSL 2.2 (OpenBSD 5.8) | |||
| 2.2.0 | 11 Jun 2015 | 84 | 32/33/3 |
| 2.2.1 | 08 Jul 2015 | 27 | 33/34/4 |
| 2.2.2 | 06 Aug 2015 | 29 | 35/35/6 |
| 2.2.3 | 29 Aug 2015 | 23 | 35/35/6 |
| 2.2.4 | 15 Oct 2015 | 47 | 35/35/6 |
| 2.2.5 | 08 Dec 2015 | 54 | 35/35/6 |
| 2.2.6 | 28 Jan 2016 | 86 | 35/35/6 |
| LibreSSL 2.3 (OpenBSD 5.9) | |||
| 2.3.0 | 23 Sep 2015 | 29 | 36/37/9 |
| 2.3.1 | 03 Nov 2015 | 41 | 36/37/9 |
| 2.3.2 | 28 Jan 2016 | 86 | 37/38/10 |
| 2.3.3 | 23 Mar 2016 | 55 | 37/38/10 |
The detailed version history was moved to the LibreSSL history sub-page
Ports
Detailed information on specific ports can now be found in the sub-page
The first build of all ports with LibreSSL for PC-BSD revealed 81 ports which require patching to work properly.
The build of all ports with LibreSSL 2.3, which has removed SSLv3, revealed 92 ports which require patching to work. This has been captured in the OpenSSL section as this fallout is considered equal to the fallout of building all ports with OpenSSL with SSLv3 disabled (security_openssl_UNSET=SSL3 / –no-ssl3).
Types of Failures
Note: Counts are not up-to-date
| Problem | Description | Count | PRs | Unsolved | |
|---|---|---|---|---|---|
| Open | Closed | ||||
| EGD | uses RAND_egd methods that no longer exist in LibreSSL | 32 | 12 | 16 | 0 |
| DES | Uses deprecated des_ methods (replaced by DES_ methods) | 19 | 4 | 15 | 0 |
| SSLv2 | Uses SSLv2 methods that no longer exist in LibreSSL | 5 | 2 | 3 | 0 |
| COMP | Wants SSL compression | 10 | 7 | 4 | 1 |
| arc4rand | conflict in FreeBSD/LibreSSL libs | 3 | 0 | 0 | 3 |
| CMS | Uses deprecated S/MIME methods | 2 | 0 | 2 | 0 |
| GOST | Uses removed GOST methods | 2 | 0 | 2 | 0 |
| PSK | Uses PSK methods | 3 | 1 | 0 | 2 |
| SSLv3 | Uses SSLv3 methods that no longer exist in LibreSSL 2.3 | 73 | 10 | 0 | 5 |
| SHA-0 | Uses SHA-0 methods | 7 | 0 | 0 | 4 |
| Other | Other issues | 34 | 2 | 13 | 8 |
| TOTAL | 186 | 30 | 51 | 33 | |
The net-p2p/bitcoin and other virtual currency applications will/can not be fixed, they require bug-compatible OpenSSL libaries.
You can find examples of fixes in this GitHub repo, cross-reference with the PC-BSD 10.1.2 ports build chapter of the Ports sub-page.
Specific guidance for fixing the problems in the table above can be found here
LibreSSL (and OpenSSL) Security Vulnerabilities
Advisories prior to the initial release of LibreSSL (portable) are not included.
| Severity | LibreSSL | OpenSSL |
|---|---|---|
| Critical+ | ||
| High | 0 | 5 |
| Medium* | 16 | 31 |
| Low | 7 | 12 |
| Total | 19 | 36 |
* NVD Medium + OpenSSL Moderate
+ OpenSSL added Critical level in revised severity rating 2015-09-28
The list of vulnerabilities of OpenSSL and LibreSSL is kept up-to-date in the Wikipedia LibreSSL article
Links
Some more info
- lib/25367 arc4random state is shared across forks
- LibreSSL: More Than 30 Days Later (EuroBSDCon Paper)
- EuroBSDCon 2014 presentation arc4random: 1996 to present