Building Python with SSL Support in Non-Standard Locations: A Configuration and Compilation Guide

Background and Challenges

On RHEL systems without root access, users often need to install Python and its modules in non-standard locations (e.g., ~/local), particularly for modules that depend on Python.h and SSL support. Common issues include Python failing to find SSL libraries during compilation, leading to build failures for the _ssl and _hashlib modules. For example, users may run ./configure --prefix=/home/fds/rms/local and make, but logs indicate that the SSL module is not compiled, with errors like Failed to find the necessary bits to build these modules: _ssl. Even after installing OpenSSL to a custom path (e.g., /home/fds/rms/local), compilation may still fail because default system search paths (e.g., /lib, /usr/lib) do not include the custom library location.

Core Solution: Editing Modules/Setup.dist

The primary solution involves modifying the Modules/Setup.dist file in the Python source code to explicitly specify the OpenSSL installation path. Based on the best answer, the steps are as follows:

1. Install OpenSSL: First, compile and install OpenSSL in a custom location. For example, use ./config --prefix=/home/fds/rms/local shared, followed by make and make install. Ensure library files (e.g., libssl.so) are in /home/fds/rms/local/lib.
2. Modify Python Configuration: Navigate to the Python source directory and edit the Modules/Setup.dist file. Locate the SSL-related section (typically lines 206-209), uncomment it, and modify the SSL variable to point to the OpenSSL path. For example:

   SSL=/home/fds/rms/local
   _ssl _ssl.c \
       -DUSE_SSL -I$(SSL)/include -I$(SSL)/include/openssl \
       -L$(SSL)/lib -lssl -lcrypto

   This ensures the correct include and library paths are used during compilation.
3. Clean and Recompile: Run make distclean to clear previous builds, then re-run ./configure and make. For example:

   ./configure --prefix=/home/fds/rms/local
   make

   After compilation, the SSL module should be successfully built.
4. Verify Installation: Use Python test scripts to verify SSL support, such as running python -c "import ssl; print('SSL module loaded successfully')" or executing SSL-related tests from the standard test suite.

Supplementary Methods and Considerations

Other answers provide additional insights and optimizations:

• Using LDFLAGS and rpath: When configuring Python, set LDFLAGS to add runtime library search paths. For example:

  LDFLAGS="-L/home/fds/rms/local/lib -Wl,-rpath=/home/fds/rms/local/lib" ./configure --prefix=/home/fds/rms/local

  This ensures that compiled shared objects (e.g., _ssl.so) can correctly find custom libraries at runtime, avoiding reliance on default system paths. Note that the -rpath option embeds paths into binaries but should be used cautiously to avoid compatibility issues.
• Environment Variable Setup: For both compilation and runtime, set the LD_LIBRARY_PATH environment variable to temporarily add library search paths. For example:

  export LD_LIBRARY_PATH=/home/fds/rms/local/lib:$LD_LIBRARY_PATH

  However, this method may not be persistent and can be restricted in certain security contexts.
• Avoiding Common Pitfalls: Ensure OpenSSL version compatibility with Python (e.g., Python 2.6 may require OpenSSL 0.9.8). Use tools like strace or ldd to debug library loading issues, such as checking dependencies of _ssl.so. If problems persist, verify file permissions and symbolic links are correctly set.

Conclusion and Best Practices

When building Python with SSL support in non-standard locations, editing Modules/Setup.dist is a reliable core method, as it directly controls compilation parameters. Combining this with LDFLAGS and rpath can enhance runtime stability. It is recommended to always start with a clean source code, test each step incrementally, and refer to official documentation and community resources for up-to-date guidance. By following this approach, users can successfully deploy a fully functional Python environment in restricted settings.