Cryptography: ImportError /site-packages/cryptography/hazmat/bindings/_openssl.so: undefined symbol: OBJ_cleanup

[leesunkeuy]

Hi, I got this error

Traceback (most recent call last):
  File \"/home1/irteam/pkgs/dp_2017_01_10_07_55_28/tasks/async_tasks.py\", line 27, in run
    dc_result.update(f(kwargs))
  File \"/home1/irteam/pkgs/dp_2017_01_10_07_55_28/tasks/async/core.py\", line 6, in push_alert
    return push.process(**kwargs)
  File \"/home1/irteam/pkgs/dp_2017_01_10_07_55_28/push/core.py\", line 68, in process
    with apns.get_connection_token_base(apns_cert) as conn:
  File \"/home1/irteam/pkgs/dp_2017_01_10_07_55_28/push/apns.py\", line 57, in __enter__
    self._make_token()
  File \"/home1/irteam/pkgs/dp_2017_01_10_07_55_28/push/apns.py\", line 74, in _make_token
    'kid' : kid
  File \"/home1/irteam/apps/lib/python2.7/site-packages/jwt/api_jwt.py\", line 56, in encode
    json_payload, key, algorithm, headers, json_encoder
  File \"/home1/irteam/apps/lib/python2.7/site-packages/jwt/api_jws.py\", line 98, in encode
    key = alg_obj.prepare_key(key)
  File \"/home1/irteam/apps/lib/python2.7/site-packages/jwt/algorithms.py\", line 224, in prepare_key
    key = load_pem_public_key(key, backend=default_backend())
  File \"/home1/irteam/apps/lib/python2.7/site-packages/cryptography/hazmat/backends/__init__.py\", line 71, in default_backend
    _default_backend = MultiBackend(_available_backends())
  File \"/home1/irteam/apps/lib/python2.7/site-packages/cryptography/hazmat/backends/__init__.py\", line 28, in _available_backends
    \"cryptography.backends\"
  File \"/home1/irteam/apps/lib/python2.7/site-packages/pkg_resources/__init__.py\", line 2297, in resolve
    module = __import__(self.module_name, fromlist=['__name__'], level=0)
  File \"/home1/irteam/apps/lib/python2.7/site-packages/cryptography/hazmat/backends/openssl/__init__.py\", line 7, in <module>
    from cryptography.hazmat.backends.openssl.backend import backend
  File \"/home1/irteam/apps/lib/python2.7/site-packages/cryptography/hazmat/backends/openssl/backend.py\", line 51, in <module>
    from cryptography.hazmat.bindings._openssl import ffi as _ffi
ImportError: /home1/irteam/apps/lib/python2.7/site-packages/cryptography/hazmat/bindings/_openssl.so: undefined symbol: OBJ_cleanup

I think I use custom openssl, so that has little problem.. It just guess..

Python2.7.13
openssl 1.1.0c
recent cryptography

[vanhonit]

I got the same error.

[alex]

This error looks like what would occur if you compiled cryptography against one set of headers, and linked it against a different openssl's .so

[vanhonit]

@alex, Do you have any suggestion? I try reinstall cryptography, re-complie openssl many time but cannot.

[leesunkeuy]

@alex So you mean I need to set some option , when I install crptography?
like pip install --global-option=build_ext --global-option="-L/path/to/local" crptography

[reaperhulk]

Using a custom OpenSSL requires a significant amount of expertise with the quirks of the C toolchain and the dynamic linker. It's extremely difficult to provide support for such a configuration due to the myriad ways it can be done (each with its own set of issues). I'd strongly recommend against trying to link against anything other than your original system OpenSSL on linux.

[leesunkeuy]

@reaperhulk Thank you for your answer.
I want to use http/2 for APNS token authorized, but amazonlinux support lower openssl(1.0.1), that version can't work for http/2, at least openssl(1.0.2) is needed.
https://forums.aws.amazon.com/thread.jspa?messageID=759633#759633

[reaperhulk]

To successfully do that you'll need to either use rpath or alter the soversion of your 1.0.2 compile to allow the dynamic linker to disambiguate between version 1.0.1 and 1.0.2 on your system (both of which ship with the same soversion normally).

Since this is unfortunately more of a C toolchain problem than a problem with this library I'm going to go ahead and close this.

[schors]

Sorry. I have a solution of this problem. Actually It's py-cryptography library build stage problem. This error occurs when two conditions are satisfied. First is openssl 1.1.0 and greater in the system so build utils prefers that. Second is header file "openssl/objects.h" from versions less than 1.1.0 so build utils prefers this file. "OBJ_cleanup" was deprecated in openssl 1.1.0. py-cryptography building process matches "openssl/objects.h" and objects.py (somewhere inside source code tree) to collecting binding's symbols. So ooops... It is required to explicitly set the headers file path. Like this:
CFLAGS="-I/opt/openssl/include" pip3 install -U cryptography
or this
LDFLAGS="-L/opt/openssl/lib -Wl,-rpath,/opt/openssl/lib" CFLAGS="-I/opt/openssl/include" pip3 install -U cryptography