Installing Python 3.7 on Debian 8

I have a Debian Jessie box that needed to get Python 3.7 running and it was not so straight forward.

Here are some of the errors I experienced during the trial and error of figuring this out:

ERROR: The Python ssl extension was not compiled. Missing the OpenSSL lib?
Following modules built successfully but were removed because they could not be imported:
_ssl

Could not build the ssl module!
Python requires an OpenSSL 1.0.2 or 1.1 compatible libssl with X509_VERIFY_PARAM_set1_host().
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate

Fixing things

First, some prerequisites:

sudo apt-get install build-essential checkinstall libreadline-gplv2-dev libncursesw5-dev libsqlite3-dev tk-dev libgdbm-dev libc6-dev libbz2-dev

The first problem is that the packaged versions of openssl and libssl-dev are missing header information required to build Python 3.7+ so you will have to compile your own:

cd /usr/src
curl https://www.openssl.org/source/openssl-1.0.2o.tar.gz | tar xz
cd openssl-1.0.2o
./config shared --prefix=/usr/local/
sudo make
sudo make install

We will need to pass /usr/src/openssl-1.0.2o into the Python configure script. However, the configure script will look for a lib directory in that path which doesn’t exist. So we’ll create that manually:

mkdir lib
cp ./*.{so,so.1.0.0,a,pc} ./lib

Now proceed with installing Python:

cd /usr/src
sudo wget https://www.python.org/ftp/python/3.7.0/Python-3.7.0.tgz
sudo tar xzf Python-3.7.0.tgz
cd Python-3.7.0
./configure --with-openssl=/usr/src/openssl-1.0.2o --enable-optimizations
sudo make
sudo make altinstall

To test it out, run python3.7 and input:

import ssl
ssl.OPENSSL_VERSION

You should see a string like 'OpenSSL 1.0.2o 27 Mar 2018' in return.

I don’t know if this will apply for everyone, but I also had to install certifi and manually link the certificate.

pip3.7 install certifi
sudo ln -s /usr/local/lib/python3.7/site-packages/certifi/cacert.pem /usr/local/ssl/cert.pem

Comments (9)

Alan Tegel
Tuesday, Apr 2, 2019

Thank you …. this suggestion was a god-send.

David
Friday, Apr 26, 2019

I’m trying to build Python 3.7.3 on a Raspberry Pi. I followed your instructions, but still get the following errors:

*** WARNING: renaming "_ssl" since importing it failed: build/lib.linux-armv7l-3.7/_ssl.cpython-37m-arm-linux-gnueabihf.so: undefined symbol: X509_VERIFY_PARAM_set_hostflags

Python build finished successfully!
The necessary bits to build these optional modules were not found:
_uuid
To find the necessary bits, look in setup.py in detect_modules() for the module's name.


The following modules found by detect_modules() in setup.py, have been
built by the Makefile instead, as configured by the Setup files:
_abc                  atexit                pwd
time


Following modules built successfully but were removed because they could not be imported:
_ssl


Could not build the ssl module!
Python requires an OpenSSL 1.0.2 or 1.1 compatible libssl with X509_VERIFY_PARAM_set1_host().
LibreSSL 2.6.4 and earlier do not provide the necessary APIs, https://github.com/libressl-portable/portable/issues/381

James Kiefer
In reply to David
Friday, Apr 26, 2019

Hmm. I can’t tell what the problem is just from that snippet. Maybe if you could copy the log from the entire process and paste it into a gist I might be able to help more.

David
In reply to David
Saturday, Apr 27, 2019

I’m not sure if this is of any interest, but the original openssl package is still installed on the Pi. It’s version 1.0.1.

$ /usr/bin/openssl version
OpenSSL 1.0.1t  3 May 2016
$ /usr/local/bin/openssl version
OpenSSL 1.0.2o  27 Mar 2018

I’d like to get rid of the old one and replace it with the new, but the old one is installed / managed by apt-get. Is it safe to just copy my built one on top of it? But then, how do I know what needs copying?

James Kiefer
In reply to David
Saturday, Apr 27, 2019

Yeah, I think that is the problem. The first time I read through your command log I found a line warning about /usr/local but this morning I can’t seem to find it again. Try changing the configure command to point at /usr and see if we get any improvement:

./config shared --prefix=/usr

David
In reply to David
Thursday, May 2, 2019

I ended up just upgrading from Jessie to Stretch, which comes with OpenSSL 1.1.0.

Molly
Monday, Jun 3, 2019

libffi-dev is also needed in the prerequisite dependency. Also, since my GCC is of older version (4.9.2), I need to get rid of “–enable-optimizations” to make it work. After those two fixes, the tutorial works as magic. Thank you!

Reference: https://bugs.python.org/issue35074 https://bugs.python.org/issue31652

Bonkey
Tuesday, Jun 11, 2019

Thanks for this. I spent the whole day trying to get past this issue, trying to distribute software on an older OS version. The lib folder was the last little bit I needed.

Thank you

Your comment has been submitted and will be published once it has been approved.

OOPS!

Your comment has not been submitted. Please go back and try again. Thank You!

If this error persists, please open an issue by clicking here.

Say something