Skip to content

Support for dynamically linking against system OpenSSL #1984

Open

Description

@Xaeroxe

Feature Request

For my project I'd like to dynamically link against the OpenSSL library from the host system for a few reasons.

  1. New security fixes, the current OpenSSL (3.0.10) went End of Life last month.
  2. Consolidation of the cryptography stack in my app.
  3. I only need to support systems which can provide their own OpenSSL anyways.

I have a fork in which I've implemented this feature. I'm opening this issue to check whether mediasoup has interest in upstreaming this. Full disclosure, my implementation is created with the aid of Claude Opus 5.5, however I have reviewed and tested the code.

Activity

  1. ibc commented on Oct 9, 2026

    @ibc
    Member

    I am updating OpenSSL to 3.5.9 in Meson WrapDB to be able to modernize OpenSSL in mediasoup:

    mesonbuild/wrapdb#2956

    Please let me know how you implemented dynamic linking.

  2. Xaeroxe commented on Oct 9, 2026

    @Xaeroxe
    Author

    @ibc you can review the changes at v3...Xaeroxe:mediasoup:system-openssl

    The primary thrust of it can be found here and here. A new Meson build argument is added, ms_system_openssl which is false by default. When it is true we do not add libcrypto_lib or libssl_lib from openssl_proj to the link_whole value in the meson.build. Additionally, openssl_proj.get_variable('openssl_dep') is moved into a new value, openssl_dep. When the dynamic linking feature is enabled, openssl_dep instead contains a new value, dependency('openssl', version: '>=3.0.0', allow_fallback: false). The Rust build.rs then uses pkg-config to locate the needed libraries and provide it to the meson build. This feature is then propagated upwards through cargo features so that downstream doesn't need to declare a dependency on mediasoup-sys to use it.

    I'm running CI on my own fork right now to test this more broadly but it seems to work for me.

  3. ibc commented on Oct 9, 2026

    @ibc
    Member

    Ok, thanks. Not sure when we will be able to check that in depth (lot of priority stuff to be done before) but we will do it eventually. I will keep this ticket open to not forget.

  4. Xaeroxe commented on Oct 9, 2026

    @Xaeroxe
    Author

    You should also be aware that my change surfaced a bug in how OpenSSL is invoked by mediasoup. This bug never causes an issue on the code base as-is but OpenSSL 3.0 and 3.1 with kernel TLS will experience it. I've already applied a fix on my branch. 6024426

  5. ibc commented on Oct 9, 2026

    @ibc
    Member

    5. You should also be aware that my change surfaced a bug in how OpenSSL is invoked by mediasoup. This bug never causes an issue on the code base as-is but OpenSSL 3.0 and 3.1 with kernel TLS will experience it. I've already applied a fix on my branch. 6024426

    Thanks. Added here in a separate task: #1989

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions