XW512 commented on issue #12534: URL: https://github.com/apache/apisix/issues/12534#issuecomment-3204776199
> The error about `undefined symbol: EVP_KDF_ctrl, version OPENSSL_1_1_1b` points to a mismatch between the OpenSSL version expected by a native library (likely `lualdap` or a dependency like `libk5crypto.so.3`) and the OpenSSL libraries actually present on your system. This isn't caused by APISIX code or plugin logic, but by how native libraries are linked and loaded in your environment. > > APISIX and its plugins don't hardcode or manage OpenSSL linkage directly—they rely on the OS and package manager to resolve native dependencies. OpenResty maintains its own patched OpenSSL package, and version mismatches can happen if a native module (like `lualdap`) was built against a different OpenSSL version than what is loaded at runtime, or if the system OpenSSL is being picked up instead of the bundled one [see here](https://api7.ai/learning-center/openresty/hello-world-in-openresty). > > To troubleshoot: > > * Check which OpenSSL library is actually being loaded at runtime (e.g., with `ldd /usr/local/apisix/deps/lib/lua/5.1/lualdap.so`). > * Make sure all native modules (especially `lualdap`) are built against the same OpenSSL version as provided by `openresty-openssl111`. > * Ensure your `LD_LIBRARY_PATH` includes the directory for the correct OpenResty OpenSSL libraries before starting APISIX. > * If you have a system-wide OpenSSL (like 1.1.1k FIPS) and a bundled OpenResty OpenSSL (1.1.1w), conflicts can occur—try rebuilding or reinstalling `lualdap` so it links against the correct OpenSSL. > > There are no known APISIX-side fixes or configuration options for this; the solution is to align your native library builds and runtime environment. > > _Written by [@dosu](https://github.com/dosu), approved by moonming_ > > _To reply, just mention [@dosu](https://go.dosu.dev/dosubot)._ > > How did I do? [Good](https://app.dosu.dev/response-feedback/cd5381f1-a54b-42e9-b0f7-a52191f1c92f?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/cd5381f1-a54b-42e9-b0f7-a52191f1c92f?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/cd5381f1-a54b-42e9-b0f7-a52191f1c92f?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/cd5381f1-a54b-42e9-b0f7-a52191f1c92f?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/cd5381f1-a54b-42e9-b0f7-a52191f1c92f?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/cd5381f1-a54b-42e9-b0f7-a52191f1c92f?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/cd5381f1-a54b-42e9-b0f7-a52191f1c92f?feedback_type=other) [](https://app.dosu.dev/6aff3395-54f4-4ca2-8624-021d21c2f031/ask?utm_source=github) [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/apisix/issues/12534) Thank you for your reply. Can I comment out the LDAP plugin as I am not currently using it? Also, I would like to ask if the apisix3 version has been consistently packaged -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: notifications-unsubscr...@apisix.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org
