Hello guys, here are my troubles :
**Component:** Linux distribution packaging / Debian 13 Trixie
**Checkmk version:** 2.4.0p22 RAW (check-mk-raw-2.4.0p22_0.trixie_amd64.deb)
**OS:** Debian 13 Trixie
**Edition:** Checkmk Raw (CRE)
Summary
Enabling OpenID Connect (and similarly SAML) on Checkmk 2.4.0p22 installed on Debian 13 Trixie results in a fatal library conflict that makes authentication completely non-functional. The root cause is a double OpenSSL dependency conflict in the Trixie package that cannot be worked around from the outside.
Symptoms
When OpenID Connect is enabled, one of the following errors appears in ~/var/log/apache/error_log:
**Error 1** (without any LD_PRELOAD workaround):
```
ImportError: libssl.so.3: version OPENSSL_3.2.0 not found
(required by /usr/lib/x86_64-linux-gnu/libcurl.so.4)
```
**Error 2** (when attempting to force system libcurl via LD_PRELOAD):
```
ImportError: …/cryptography/hazmat/bindings/_rust.abi3.so:
undefined symbol: EVP_idea_ecb, version OPENSSL_3.0.0
```
Root Cause Analysis
The Trixie package ships its own bundled libssl.so.3 / libcrypto.so.3 (OpenSSL **3.0.19**), and sets LD_LIBRARY_PATH to prioritize them. However, two mutually exclusive conflicts arise:
**Conflict 1 — system libcurl vs. bundled libssl:**
- libcurl4t64 on Trixie (v8.14.1-2) was compiled against OpenSSL 3.2+ and requires the symbol OPENSSL_3.2.0
- Checkmk’s bundled libssl.so.3 (3.0.19) only exposes OPENSSL_3.0.0 and OPENSSL_3.0.3
- When LD_LIBRARY_PATH is active, libcurl.so.4 picks up Checkmk’s bundled libssl.so.3 → crash
**Conflict 2 — bundled _rust.abi3.so vs. system libssl:**
- Checkmk’s bundled cryptography/hazmat/bindings/_rust.abi3.so requires the symbol EVP_idea_ecb (an IDEA legacy cipher)
- This symbol has been removed from OpenSSL 3.x on Trixie and is not exported by libcrypto.so.3 system, nor by the openssl-provider-legacy package
- When LD_LIBRARY_PATH is bypassed, _rust.abi3.so picks up the system libssl.so.3 → crash
**These two conflicts are mutually exclusive:** no single libssl.so.3 available on Trixie satisfies both requirements simultaneously.
Verification commands run against the package:
```
Bundled libssl version
strings /omd/sites//lib/libcrypto.so.3 | grep -E “^3\.”
→ 3.0.19
Symbols exposed by bundled libssl: only OPENSSL_3.0.0 and OPENSSL_3.0.3
Symbols exposed by system libssl: OPENSSL_3.0.0, 3.2.0, 3.3.0, 3.4.0, 3.5.0
EVP_idea_ecb absent from system libcrypto:
nm -D /usr/lib/x86_64-linux-gnu/libcrypto.so.3 | grep EVP_idea_ecb
→ (no output)
EVP_idea_ecb also absent from openssl-provider-legacy:
nm -D $(find /usr/lib -name “legacy.so”) | grep EVP_idea_ecb
→ (no output)
```
Expected Fix
my suggestions:
- **Bundle libcurl** linked against Checkmk’s own OpenSSL 3.0.19, instead of relying on the system libcurl4t64 which requires OpenSSL 3.2+
- **Recompile the cryptography Python package** (_rust.abi3.so) without dependency on legacy OpenSSL symbols such as EVP_idea_ecb, which are unavailable on modern distributions
This issue also affects SAML (same code path, same library conflict), as reported by other users on the forum.
-–
Additional Notes
This is related to Werk #18937 (OpenSSL compatibility wrappers), but the wrapper mechanism does not cover the library conflicts triggered by the OIDC/SAML code path.
This bug was identified by inspecting the contents of check-mk-raw-2.4.0p22_0.trixie_amd64.deb directly.
Best regards,