Some are deprecated from openssl 3.0

Support
1

hi I want to compile kernel 5.14.0 and got following warnings,seems mismatch with openssl 3.0.

{BA58EEE2-E3B6-4C54-8939-D6ADD64613A8}
{BA58EEE2-E3B6-4C54-8939-D6ADD64613A8}1331×169 8.74 KB

How to deal with this or that I can ignore them?

Thanks

2

Hi @rbhuang,

These warnings are expected when building older kernel versions (like 5.14.0) against newer OpenSSL 3.0, because several OpenSSL functions (e.g. ERR_get_error_line, ENGINE_load_private_key) have been deprecated or removed in OpenSSL 3.0.

Can you ignore them?
→ Usually, you can ignore these warnings if you only see warnings and the build completes successfully. However, you should test any functionality related to signing modules or cryptographic operations to be sure they work as expected.

How to deal with them?

  • Option 1: Downgrade OpenSSL to 1.1.1 (if your distro allows it) for building legacy kernels.
  • Option 2: Apply patches to the kernel source to replace deprecated OpenSSL functions. However, such patches may not be available for older kernels like 5.14.0.

For AlmaLinux, it’s recommended to build kernels that match the OS’s default OpenSSL version (which is OpenSSL 3.0 in AlmaLinux 9+). Alternatively, consider upgrading to a newer kernel that already supports OpenSSL 3.0.

Let me know your environment (distro, OpenSSL version) and I can check further.

Best regards,
Akiyoshi Kurita (redadmin)

3

hi Akiyoshi Kurita

Thanks a lot for your information.You mean that 5.14.0-* is old kernel.But all almalinux versions are 5.14.0 based.Even the 9.6 is 5.14.0-570.

From which version ,that the openssl 3.0 is supported?So I can compile that. :grin:

4

Hi @rbhuang,

Sorry, my previous explanation wasn’t clear enough.

AlmaLinux 9.x uses a 5.14.x kernel. But the OpenSSL version used inside the kernel build is not necessarily the same as the OpenSSL version installed in the OS.

AlmaLinux 9.x ships OpenSSL 3.0 by default.

The Red Hat-patched 5.14.x kernel in AlmaLinux 9.x works fine with OpenSSL 3.0.

But if you build a vanilla upstream 5.14.0 kernel, it may expect OpenSSL 1.1.1 and fail or warn when OpenSSL 3.0 is present.

So yes — the kernel version and the distro’s OpenSSL version are separate matters.

Best regards,
Akiyoshi Kurita (redadmin)

5

hi Akiyoshi Kurita

I see now.The openssl version on the compiling kernel machine must be less than 3.0.

BR