Installing Python 3.7 on Debian 8

I have a Debian Jessie box that needed to get Python 3.7 running and it was not so straight forward.

Here are some of the errors I experienced during the trial and error of figuring this out:

ERROR: The Python ssl extension was not compiled. Missing the OpenSSL lib?
Following modules built successfully but were removed because they could not be imported:

Could not build the ssl module!
Python requires an OpenSSL 1.0.2 or 1.1 compatible libssl with X509_VERIFY_PARAM_set1_host().
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate

Fixing things

First, some prerequisites:

sudo apt-get install build-essential checkinstall libreadline-gplv2-dev libncursesw5-dev libsqlite3-dev tk-dev libgdbm-dev libc6-dev libbz2-dev

The first problem is that the packaged versions of openssl and libssl-dev are missing header information required to build Python 3.7+ so you will have to compile your own:

cd /usr/src
curl | tar xz
cd openssl-1.0.2o
./config shared --prefix=/usr/local/
sudo make
sudo make install

We will need to pass /usr/src/openssl-1.0.2o into the Python configure script. However, the configure script will look for a lib directory in that path which doesn’t exist. So we’ll create that manually:

mkdir lib
cp ./*.{so,so.1.0.0,a,pc} ./lib

Now proceed with installing Python:

cd /usr/src
sudo wget
sudo tar xzf Python-3.7.0.tgz
cd Python-3.7.0
./configure --with-openssl=/usr/src/openssl-1.0.2o --enable-optimizations
sudo make
sudo make altinstall

To test it out, run python3.7 and input:

import ssl

You should see a string like 'OpenSSL 1.0.2o 27 Mar 2018' in return.

I don’t know if this will apply for everyone, but I also had to install certifi and manually link the certificate.

pip3.7 install certifi
sudo ln -s /usr/local/lib/python3.7/site-packages/certifi/cacert.pem /usr/local/ssl/cert.pem

Comments (15)

Alan Tegel
Tuesday, Apr 2, 2019

Thank you …. this suggestion was a god-send.

Friday, Apr 26, 2019

I’m trying to build Python 3.7.3 on a Raspberry Pi. I followed your instructions, but still get the following errors:

*** WARNING: renaming "_ssl" since importing it failed: build/lib.linux-armv7l-3.7/ undefined symbol: X509_VERIFY_PARAM_set_hostflags

Python build finished successfully!
The necessary bits to build these optional modules were not found:
To find the necessary bits, look in in detect_modules() for the module's name.

The following modules found by detect_modules() in, have been
built by the Makefile instead, as configured by the Setup files:
_abc                  atexit                pwd

Following modules built successfully but were removed because they could not be imported:

Could not build the ssl module!
Python requires an OpenSSL 1.0.2 or 1.1 compatible libssl with X509_VERIFY_PARAM_set1_host().
LibreSSL 2.6.4 and earlier do not provide the necessary APIs,

James Kiefer
In reply to David
Friday, Apr 26, 2019

Hmm. I can’t tell what the problem is just from that snippet. Maybe if you could copy the log from the entire process and paste it into a gist I might be able to help more.

In reply to David
Saturday, Apr 27, 2019

I’m not sure if this is of any interest, but the original openssl package is still installed on the Pi. It’s version 1.0.1.

$ /usr/bin/openssl version
OpenSSL 1.0.1t  3 May 2016
$ /usr/local/bin/openssl version
OpenSSL 1.0.2o  27 Mar 2018

I’d like to get rid of the old one and replace it with the new, but the old one is installed / managed by apt-get. Is it safe to just copy my built one on top of it? But then, how do I know what needs copying?

James Kiefer
In reply to David
Saturday, Apr 27, 2019

Yeah, I think that is the problem. The first time I read through your command log I found a line warning about /usr/local but this morning I can’t seem to find it again. Try changing the configure command to point at /usr and see if we get any improvement:

./config shared --prefix=/usr

In reply to David
Thursday, May 2, 2019

I ended up just upgrading from Jessie to Stretch, which comes with OpenSSL 1.1.0.

In reply to David
Thursday, Jun 20, 2019

@James Kiefer: Thanks for this post. It helps me alot. I successfully upgraded Python to v3.7.3 on Ubuntu14 32bit (has SSL 1.0.2f). I also faced error “undefined symbol” as David did. (when I compiled same version of openssl as in Ubuntu14) Problem was solved after I changed to use openssl 1.1.

Monday, Jun 3, 2019

libffi-dev is also needed in the prerequisite dependency. Also, since my GCC is of older version (4.9.2), I need to get rid of “–enable-optimizations” to make it work. After those two fixes, the tutorial works as magic. Thank you!


In reply to Molly
Thursday, Jan 16, 2020

Works exactly the way as Molly said: libffi-dev is not usually a preinstalled package, needs to be added on Debian 8 “Jessie”.

Tuesday, Jun 11, 2019

Thanks for this. I spent the whole day trying to get past this issue, trying to distribute software on an older OS version. The lib folder was the last little bit I needed.

Monday, Jul 15, 2019

These helped me get this BS working :p

export LDFLAGS="-L/usr/local/lib/"

export LD_LIBRARY_PATH="/usr/local/lib/"

export CPPFLAGS="-I/usr/local/include -I/usr/local/include/openssl"

Victor Villarreal
Sunday, Dec 15, 2019


It’s works like a charm for Python 3.7.5, OpenSSL 1.1d and Debian8.

Thanks you for your post! Cheers.

Sunday, Jan 26, 2020

Hi! had some trouble with the OpenSSL bit attempting a Python 3.7.6 install.

I used OpenSSL 1.1.0l, so i just changed the so.1.0 files to so.1.1, and before running make on python, i had to run ldconfig so /usr/local/bin/openssl would run properly. also had to run the python ./configure without the –enable-optimizations switch.

i also had an issue with _ctypes module, quicly solved by running apt-get install libffi-dev.

Wednesday, Mar 4, 2020

This step really helped! Thank you!

“./configure –with-openssl=/usr/src/openssl-1.0.2o –enable-optimizations”

Thank you

Your comment has been submitted and will be published once it has been approved.


Your comment has not been submitted. Please go back and try again. Thank You!

If this error persists, please open an issue by clicking here.

Say something