Raspbian support for TLS 1.3

Question

Are there or will there be packages available to support TLS 1.3 on Raspbian GNU/Linux 9 (stretch)? For example OpenSSL 1.1.1{,a,b}?

Answer 1

For those who don't mind manually upgrading to OpenSSL 1.1.1 in Raspbian, there is easy way of doing so in Unix system:

• (Optionally) Remove previous OpenSSL by running apt-get remove openssl
• Download the entire OpenSSL source code from its official Github repository by running git clone https://github.com/openssl/openssl.git
• Go to the downloaded openssl folder,
• Check the latest release version by running git tag and git rev-parse <TAG_NAME>, the git rev-parse will show the commit ID of the tag name. Then roll back to that version by git checkout <COMMIT_ID> (In the case here, the version is 1.1.1c).
• Open the file named INSTALL, simply follow the steps described in Quick Start of INSTALL. For example here are all the steps in Unix system (Note that make and make test take few hours to complete) :

./config
make
make test
make install

• Modify the link files, libssl.so.1.1 , libcrypto.so.1.1 in /usr/lib/arm-linux-gnueabihf/ (commands shown below). Because the openssl libraries we manually built are copied to /usr/local/lib (by previous make install), while installation from package management tool like apt-get will copy the pre-built libraries to different folder (which is /usr/lib/arm-linux-gnueabihf/ in Raspbian).

cd  /usr/lib/arm-linux-gnueabihf/
sudo unlink libssl.so.1.1
sudo unlink libcrypto.so.1.1
sudo ln -s /usr/local/lib/libssl.so.1.1      libssl.so.1.1
sudo ln -s /usr/local/lib/libcrypto.so.1.1   libcrypto.so.1.1

After steps above, you can check your openssl version again:

openssl version
> OpenSSL 1.1.1c  28 May 2019

I also built MQTT message server/client with this openSSL v1.1.1, run the MQTT server/client, and debug/capture packets using wireshark, it works well & TLS v1.3 can be enabled for sure.

Answer 2

What I found out in my research, and also the comment suggests:

At the moment there is no way of getting openssl 1.1.1 to Raspian Stretch and I have wait for the next release, Raspian Buster.

Thank you for confirming that.

Answer 3

apt-cache search shows many openssl packages.

$ apt-cache search openssl

acme-tiny - letsencrypt tiny Python client
aolserver4-nsopenssl - AOLserver 4 module: module for SSL mode
apache2-ssl-dev - Apache HTTP Server (mod_ssl development headers)
bruteforce-salted-openssl - try to find the passphrase for files encrypted with OpenSSL
cl-plus-ssl - Common Lisp interface to OpenSSL
cryptmount - Management of encrypted file systems
dehydrated - ACME client implemented in Bash
dlang-openssl - D version of the C headers for openssl
erlang-crypto - Erlang/OTP cryptographic modules
erlang-p1-fast-tls - native TLS / SSL driver for Erlang / Elixir
erlang-p1-tls - native TLS / SSL driver for Erlang / Elixir
forensics-all - Debian Forensics Environment - essential components (metapackage)
fp-units-net - Free Pascal - networking units dependency package
fp-units-net-3.0.0 - Free Pascal - networking units
gambas3-gb-openssl - Gambas OpenSSL component
gjots2 - Simple jotter (outline processor) for X11/gtk-gnome
globus-gsi-cert-utils-progs - Globus Toolkit - Globus GSI Cert Utils Library Programs
heartbleeder - test servers for OpenSSL CVE-2014-0160 aka Heartbleed
hiera-eyaml - OpenSSL Encryption backend for Hiera
jruby-openssl - Ruby library that emulates the OpenSSL native library for JRuby
kamailio-tls-modules - contains the TLS kamailio transport module
keyringer - Distributed secret management using GnuPG and Git
lcmaps-openssl-interface - LCMAPS header files for OpenSSL interfaces
letsencrypt.sh - ACME client - transitional dummy package to dehydrated
libace-ssl-6.3.3 - ACE secure socket layer library
libapache2-mod-gnutls - Apache module for SSL and TLS encryption with GnuTLS
libapache2-mod-php7.0 - server-side, HTML-embedded scripting language (Apache 2 module)
libbellesip-dbg - SIP stack from Linphone team (debugging symbols)
libbellesip-dev - SIP stack from the Linphone team (development files)
libbellesip0 - SIP stack from the Linphone team
libcrypt-openssl-bignum-perl - Perl module to access OpenSSL multiprecision integer arithmetic libraries
libcrypt-openssl-dsa-perl - module which implements the DSA signature verification system
libcrypt-openssl-pkcs10-perl - Perl extension to OpenSSL's PKCS10 API
libcrypt-openssl-pkcs12-perl - Perl extension to OpenSSL's PKCS12 API
libcrypt-openssl-random-perl - module to access the OpenSSL pseudo-random number generator
libcrypt-openssl-rsa-perl - module for RSA encryption using OpenSSL
libcrypt-openssl-x509-perl - Perl extension to OpenSSL's X509 API
libcrypt-ssleay-perl - OpenSSL support for LWP
libcurl3 - easy-to-use client-side URL transfer library (OpenSSL flavour)
libcurl3-dbg - debugging symbols for libcurl (OpenSSL, GnuTLS and NSS flavours)
libcurl4-openssl-dev - development files and documentation for libcurl (OpenSSL flavour)
libengine-pkcs11-openssl - OpenSSL engine for PKCS#11 modules
libengine-pkcs11-openssl1.1 - OpenSSL 1.1 engine for PKCS#11 modules
libevent-openssl-2.0-5 - Asynchronous event notification library (openssl)
libghc-cipher-aes-dev - Fast AES cipher implementation
libghc-cipher-aes-doc - Fast AES cipher implementation; documentation
libghc-cipher-aes-prof - Fast AES cipher implementation; profiling libraries
libghc-hookup-dev - abstraction over network connections with SOCKS5 and TLS
libghc-hookup-doc - abstraction over network connections with SOCKS5 and TLS; documentation
libghc-hookup-prof - abstraction over network connections with SOCKS5 and TLS; profiling libraries
libghc-hsopenssl-dev - partial OpenSSL binding for Haskell
libghc-hsopenssl-doc - partial OpenSSL binding for Haskell; documentation
libghc-hsopenssl-prof - partial OpenSSL binding for Haskell; profiling libraries
libghc-hsopenssl-x509-system-dev - use system's native CA certificate store with HsOpenSSL
libghc-hsopenssl-x509-system-doc - use system's native CA certificate store with HsOpenSSL; documentation
libghc-hsopenssl-x509-system-prof - use system's native CA certificate store with HsOpenSSL; profiling libraries
libghc-openssl-streams-dev - OpenSSL network support for io-streams
libghc-openssl-streams-doc - OpenSSL network support for io-streams; documentation
libghc-openssl-streams-prof - OpenSSL network support for io-streams; profiling libraries
libghc-sha-dev - Haskell SHA suite of message digest functions
libghc-sha-doc - Haskell SHA suite of message digest functions; documentation
libghc-sha-prof - Haskell SHA suite of message digest functions; profiling libraries
libglobus-gsi-openssl-error-dbg - Globus Toolkit - Globus OpenSSL Error Handling Debug Symbols
libglobus-gsi-openssl-error-dev - Globus Toolkit - Globus OpenSSL Error Handling Development Files
libglobus-gsi-openssl-error-doc - Globus Toolkit - Globus OpenSSL Error Handling Documentation Files
libglobus-gsi-openssl-error0 - Globus Toolkit - Globus OpenSSL Error Handling
libglobus-openssl-module-dbg - Globus Toolkit - Globus OpenSSL Module Wrapper Debug Symbols
libglobus-openssl-module-dev - Globus Toolkit - Globus OpenSSL Module Wrapper Development Files
libglobus-openssl-module-doc - Globus Toolkit - Globus OpenSSL Module Wrapper Documentation Files
libglobus-openssl-module0 - Globus Toolkit - Globus OpenSSL Module Wrapper
libgnutls-openssl27 - GNU TLS library - OpenSSL wrapper
libgnutls28-dev - GNU TLS library - development files
libjs-jsencrypt - RSA Encryption in JavaScript
libjs-strophe - Library for writing XMPP clients
liblwt-ocaml-doc - cooperative light-weight thread library (documentation)
liblwt-ssl-ocaml - cooperative OpenSSL bindings for OCaml (runtime)
liblwt-ssl-ocaml-dev - cooperative OpenSSL bindings for OCaml
libneon27 - HTTP and WebDAV client library
libnetty-tcnative-java - Tomcat native fork for Netty
libnetty-tcnative-jni - Tomcat native fork for Netty (JNI library)
libnot-yet-commons-ssl-java - Not-yet-commons-SSL is a library to make SSL in Java easier
libnot-yet-commons-ssl-java-doc - Documentation for Not-yet-commons-SSL
libphp7.0-embed - HTML-embedded scripting language (Embedded SAPI library)
libpion-5.0 - lightweight HTTP interface library - runtime files
libpion-dev - lightweight HTTP interface library - development files
libpion-doc - lightweight HTTP interface library - documentation
libpion-plugins - lightweight HTTP interface library - plugins
libpoe-filter-ssl-perl - module to make SSL in POE easy and flexible
libshadowsocks-libev-dev - lightweight and secure socks5 proxy (development files)
libshadowsocks-libev2 - lightweight and secure socks5 proxy (shared library)
libsqlcipher-dev - SQLCipher development files
libsqlcipher0 - SQLCipher shared library
libsqlcipher0-dbg - SQLCipher debugging symbols
libssh-4 - tiny C SSH library (OpenSSL flavor)
libssh-dev - tiny C SSH library. Development files (OpenSSL flavor)
libssl-dev - Secure Sockets Layer toolkit - development files
libssl-doc - Secure Sockets Layer toolkit - development documentation
libssl-ocaml - OCaml bindings for OpenSSL (runtime)
libssl-ocaml-dev - OCaml bindings for OpenSSL
libssl1.0-dev - Secure Sockets Layer toolkit - development files
libssl1.0.2 - Secure Sockets Layer toolkit - shared libraries
libssl1.1 - Secure Sockets Layer toolkit - shared libraries
libstrongswan-standard-plugins - strongSwan utility and crypto library (standard plugins)
libtcnative-1 - Tomcat native library using the Apache Portable Runtime
libwolfssl-dev - Development files for the wolfSSL encryption library
libwolfssl3 - wolfSSL encryption library
libxmlsec1-openssl - Openssl engine for the XML security library
lua-luaossl - OpenSSL bindings for Lua
lua-luaossl-dev - OpenSSL bindings for Lua (development package)
lua-openssl - OpenSSL bindings for Lua
lua-openssl-dev - OpenSSL bindings for Lua (development package)
mcrypt - Replacement for old unix crypt(1)
nagios-plugins-contrib - Plugins for nagios compatible monitoring systems
node-crypto-cacerts - updates SSL certificate chain to use a directory of certificates
openssl - Secure Sockets Layer toolkit - cryptographic utility
openssl-blacklist - Blacklists for  OpenSSL RSA keys and tools
openssl-blacklist-extra - Non-default blacklists of OpenSSL RSA keys
openvpn - virtual private network daemon
perl-openssl-defaults - version compatibility baseline for Perl OpenSSL packages
php7.0-cgi - server-side, HTML-embedded scripting language (CGI binary)
php7.0-cli - command-line interpreter for the PHP scripting language
php7.0-fpm - server-side, HTML-embedded scripting language (FPM-CGI binary)
php7.0-phpdbg - server-side, HTML-embedded scripting language (PHPDBG binary)
puppet-module-camptocamp-openssl - Puppet module for managing openssl configuration
pyca - Certification Authority written in Python
python-m2crypto - Python wrapper for the OpenSSL library
python-ndg-httpsclient - enhanced HTTPS support for httplib and urllib2 using PyOpenSSL for Python2
python-openssl - Python 2 wrapper around the OpenSSL library
python-openssl-doc - Python wrapper around the OpenSSL library (documentation package)
python-pyelliptic - High level Python wrapper for OpenSSL (Python 2)
python-service-identity - Service identity verification for pyOpenSSL (Python 2 module)
python-socksipychain - Python SOCKS/HTTP/SSL chaining proxy module
python-tlslite - a pure Python SSL/TLS library
python3-ndg-httpsclient - enhanced HTTPS support for httplib and urllib2 using PyOpenSSL for Python3
python3-openssl - Python 3 wrapper around the OpenSSL library
python3-pyelliptic - High level Python wrapper for OpenSSL (Python 3)
python3-service-identity - Service identity verification for pyOpenSSL (Python 3 module)
r-cran-digest - GNU R package for 'hash digest' of R data structures
r-cran-openssl - GNU R toolkit for encryption, signatures and certificates based on OpenSSL
ruby-encryptor - wrapper for the standard Ruby OpenSSL library
scrypt - File encryption utility using scrypt for key derivation
shadowsocks-libev - lightweight and secure socks5 proxy
shellinabox - publish command line shell through AJAX interface
sqlcipher - Command line interface for SQLCipher
ssl-cert - simple debconf wrapper for OpenSSL
stone - TCP/IP packet repeater in the application layer
tcl-tls - TLS OpenSSL extension to Tcl
tinyca - simple graphical program for certification authority management