FAQ revision 68651
1117521SnjlOpenSSL - Frequently Asked Questions 2151937Sjkim-------------------------------------- 3151937Sjkim 4151937Sjkim* Which is the current version of OpenSSL? 5151937Sjkim* Where is the documentation? 6151937Sjkim* How can I contact the OpenSSL developers? 7151937Sjkim* Do I need patent licenses to use OpenSSL? 8151937Sjkim* Is OpenSSL thread-safe? 9151937Sjkim* Why do I get a "PRNG not seeded" error message? 10151937Sjkim* Why does the linker complain about undefined symbols? 11151937Sjkim* Where can I get a compiled version of OpenSSL? 12151937Sjkim* I've compiled a program under Windows and it crashes: why? 13151937Sjkim* How do I read or write a DER encoded buffer using the ASN1 functions? 14151937Sjkim* I've tried using <M_some_evil_pkcs12_macro> and I get errors why? 15151937Sjkim* I've called <some function> and it fails, why? 16151937Sjkim* I just get a load of numbers for the error output, what do they mean? 17151937Sjkim* Why do I get errors about unknown algorithms? 18151937Sjkim* How do I create certificates or certificate requests? 19151937Sjkim* Why can't I create certificate requests? 20151937Sjkim* Why does <SSL program> fail with a certificate verify error? 21151937Sjkim* Why can I only use weak ciphers when I connect to a server using OpenSSL? 22151937Sjkim* How can I create DSA certificates? 23151937Sjkim* Why can't I make an SSL connection using a DSA certificate? 24151937Sjkim* How can I remove the passphrase on a private key? 25151937Sjkim* Why can't the OpenSSH configure script detect OpenSSL? 26151937Sjkim* Why does the OpenSSL test fail with "bc: command not found"? 27151937Sjkim* Why does the OpenSSL test fail with "bc: 1 no implemented"? 28151937Sjkim* Why does the OpenSSL compilation fail on Alpha True64 Unix? 29151937Sjkim* Why does the OpenSSL compilation fail with "ar: command not found"? 30151937Sjkim 31151937Sjkim 32151937Sjkim* Which is the current version of OpenSSL? 33151937Sjkim 34151937SjkimThe current version is available from <URL: http://www.openssl.org>. 35151937SjkimOpenSSL 0.9.6 was released on September 24th, 2000. 36151937Sjkim 37151937SjkimIn addition to the current stable release, you can also access daily 38151937Sjkimsnapshots of the OpenSSL development version at <URL: 39151937Sjkimftp://ftp.openssl.org/snapshot/>, or get it by anonymous CVS access. 40151937Sjkim 41151937Sjkim 42151937Sjkim* Where is the documentation? 43151937Sjkim 44151937SjkimOpenSSL is a library that provides cryptographic functionality to 45151937Sjkimapplications such as secure web servers. Be sure to read the 46151937Sjkimdocumentation of the application you want to use. The INSTALL file 47151937Sjkimexplains how to install this library. 48151937Sjkim 49151937SjkimOpenSSL includes a command line utility that can be used to perform a 50151937Sjkimvariety of cryptographic functions. It is described in the openssl(1) 51151937Sjkimmanpage. Documentation for developers is currently being written. A 52151937Sjkimfew manual pages already are available; overviews over libcrypto and 53151937Sjkimlibssl are given in the crypto(3) and ssl(3) manpages. 54151937Sjkim 55151937SjkimThe OpenSSL manpages are installed in /usr/local/ssl/man/ (or a 56151937Sjkimdifferent directory if you specified one as described in INSTALL). 57151937SjkimIn addition, you can read the most current versions at 58151937Sjkim<URL: http://www.openssl.org/docs/>. 59151937Sjkim 60151937SjkimFor information on parts of libcrypto that are not yet documented, you 61151937Sjkimmight want to read Ariel Glenn's documentation on SSLeay 0.9, OpenSSL's 62151937Sjkimpredecessor, at <URL: http://www.columbia.edu/~ariel/ssleay/>. Much 63151937Sjkimof this still applies to OpenSSL. 64151937Sjkim 65151937SjkimThere is some documentation about certificate extensions and PKCS#12 66151937Sjkimin doc/openssl.txt 67151937Sjkim 68151937SjkimThe original SSLeay documentation is included in OpenSSL as 69151937Sjkimdoc/ssleay.txt. It may be useful when none of the other resources 70151937Sjkimhelp, but please note that it reflects the obsolete version SSLeay 71151937Sjkim0.6.6. 72151937Sjkim 73151937Sjkim 74151937Sjkim* How can I contact the OpenSSL developers? 75151937Sjkim 76151937SjkimThe README file describes how to submit bug reports and patches to 77151937SjkimOpenSSL. Information on the OpenSSL mailing lists is available from 78151937Sjkim<URL: http://www.openssl.org>. 79151937Sjkim 80151937Sjkim 81151937Sjkim* Do I need patent licenses to use OpenSSL? 82151937Sjkim 83151937SjkimThe patents section of the README file lists patents that may apply to 84151937Sjkimyou if you want to use OpenSSL. For information on intellectual 85151937Sjkimproperty rights, please consult a lawyer. The OpenSSL team does not 86151937Sjkimoffer legal advice. 87151937Sjkim 88151937SjkimYou can configure OpenSSL so as not to use RC5 and IDEA by using 89151937Sjkim ./config no-rc5 no-idea 90151937Sjkim 91151937Sjkim 92151937Sjkim* Is OpenSSL thread-safe? 93151937Sjkim 94151937SjkimYes (with limitations: an SSL connection may not concurrently be used 95151937Sjkimby multiple threads). On Windows and many Unix systems, OpenSSL 96151937Sjkimautomatically uses the multi-threaded versions of the standard 97151937Sjkimlibraries. If your platform is not one of these, consult the INSTALL 98151937Sjkimfile. 99151937Sjkim 100151937SjkimMulti-threaded applications must provide two callback functions to 101151937SjkimOpenSSL. This is described in the threads(3) manpage. 102151937Sjkim 103151937Sjkim 104151937Sjkim* Why do I get a "PRNG not seeded" error message? 105151937Sjkim 106151937SjkimCryptographic software needs a source of unpredictable data to work 107151937Sjkimcorrectly. Many open source operating systems provide a "randomness 108151937Sjkimdevice" that serves this purpose. On other systems, applications have 109151937Sjkimto call the RAND_add() or RAND_seed() function with appropriate data 110151937Sjkimbefore generating keys or performing public key encryption. 111151937Sjkim 112151937SjkimSome broken applications do not do this. As of version 0.9.5, the 113151937SjkimOpenSSL functions that need randomness report an error if the random 114151937Sjkimnumber generator has not been seeded with at least 128 bits of 115151937Sjkimrandomness. If this error occurs, please contact the author of the 116151937Sjkimapplication you are using. It is likely that it never worked 117151937Sjkimcorrectly. OpenSSL 0.9.5 and later make the error visible by refusing 118151937Sjkimto perform potentially insecure encryption. 119151937Sjkim 120151937SjkimOn systems without /dev/urandom, it is a good idea to use the Entropy 121151937SjkimGathering Demon; see the RAND_egd() manpage for details. 122151937Sjkim 123151937SjkimMost components of the openssl command line tool try to use the 124151937Sjkimfile $HOME/.rnd (or $RANDFILE, if this environment variable is set) 125151937Sjkimfor seeding the PRNG. If this file does not exist or is too short, 126151937Sjkimthe "PRNG not seeded" error message may occur. 127151937Sjkim 128151937Sjkim[Note to OpenSSL 0.9.5 users: The command "openssl rsa" in version 129151937Sjkim0.9.5 does not do this and will fail on systems without /dev/urandom 130151937Sjkimwhen trying to password-encrypt an RSA key! This is a bug in the 131151937Sjkimlibrary; try a later version instead.] 132151937Sjkim 133151937SjkimFor Solaris 2.6, Tim Nibbe <tnibbe@sprint.net> and others have suggested 134151937Sjkiminstalling the SUNski package from Sun patch 105710-01 (Sparc) which 135151937Sjkimadds a /dev/random device and make sure it gets used, usually through 136151937Sjkim$RANDFILE. There are probably similar patches for the other Solaris 137151937Sjkimversions. However, be warned that /dev/random is usually a blocking 138151937Sjkimdevice, which may have some effects on OpenSSL. 139151937Sjkim 140151937Sjkim 141151937Sjkim* Why does the linker complain about undefined symbols? 142151937Sjkim 143151937SjkimMaybe the compilation was interrupted, and make doesn't notice that 144151937Sjkimsomething is missing. Run "make clean; make". 145151937Sjkim 146151937SjkimIf you used ./Configure instead of ./config, make sure that you 147151937Sjkimselected the right target. File formats may differ slightly between 148151937SjkimOS versions (for example sparcv8/sparcv9, or a.out/elf). 149151937Sjkim 150151937SjkimIn case you get errors about the following symbols, use the config 151151937Sjkimoption "no-asm", as described in INSTALL: 152151937Sjkim 153151937Sjkim BF_cbc_encrypt, BF_decrypt, BF_encrypt, CAST_cbc_encrypt, 154151937Sjkim CAST_decrypt, CAST_encrypt, RC4, RC5_32_cbc_encrypt, RC5_32_decrypt, 155151937Sjkim RC5_32_encrypt, bn_add_words, bn_div_words, bn_mul_add_words, 156151937Sjkim bn_mul_comba4, bn_mul_comba8, bn_mul_words, bn_sqr_comba4, 157151937Sjkim bn_sqr_comba8, bn_sqr_words, bn_sub_words, des_decrypt3, 158151937Sjkim des_ede3_cbc_encrypt, des_encrypt, des_encrypt2, des_encrypt3, 159151937Sjkim des_ncbc_encrypt, md5_block_asm_host_order, sha1_block_asm_data_order 160151937Sjkim 161151937SjkimIf none of these helps, you may want to try using the current snapshot. 162151937SjkimIf the problem persists, please submit a bug report. 163151937Sjkim 164151937Sjkim 165151937Sjkim* Where can I get a compiled version of OpenSSL? 166151937Sjkim 167151937SjkimSome applications that use OpenSSL are distributed in binary form. 168151937SjkimWhen using such an application, you don't need to install OpenSSL 169151937Sjkimyourself; the application will include the required parts (e.g. DLLs). 170151937Sjkim 171151937SjkimIf you want to install OpenSSL on a Windows system and you don't have 172151937Sjkima C compiler, read the "Mingw32" section of INSTALL.W32 for information 173151937Sjkimon how to obtain and install the free GNU C compiler. 174151937Sjkim 175151937SjkimA number of Linux and *BSD distributions include OpenSSL. 176151937Sjkim 177151937Sjkim 178151937Sjkim* I've compiled a program under Windows and it crashes: why? 179151937Sjkim 180151937SjkimThis is usually because you've missed the comment in INSTALL.W32. You 181151937Sjkimmust link with the multithreaded DLL version of the VC++ runtime library 182151937Sjkimotherwise the conflict will cause a program to crash: typically on the 183151937Sjkimfirst BIO related read or write operation. 184151937Sjkim 185151937Sjkim 186151937Sjkim* How do I read or write a DER encoded buffer using the ASN1 functions? 187151937Sjkim 188151937SjkimYou have two options. You can either use a memory BIO in conjunction 189151937Sjkimwith the i2d_XXX_bio() or d2i_XXX_bio() functions or you can use the 190151937Sjkimi2d_XXX(), d2i_XXX() functions directly. Since these are often the 191151937Sjkimcause of grief here are some code fragments using PKCS7 as an example: 192151937Sjkim 193151937Sjkimunsigned char *buf, *p; 194151937Sjkimint len; 195151937Sjkim 196151937Sjkimlen = i2d_PKCS7(p7, NULL); 197151937Sjkimbuf = OPENSSL_malloc(len); /* or Malloc, error checking omitted */ 198151937Sjkimp = buf; 199151937Sjkimi2d_PKCS7(p7, &p); 200151937Sjkim 201151937SjkimAt this point buf contains the len bytes of the DER encoding of 202151937Sjkimp7. 203151937Sjkim 204151937SjkimThe opposite assumes we already have len bytes in buf: 205151937Sjkim 206151937Sjkimunsigned char *p; 207151937Sjkimp = buf; 208151937Sjkimp7 = d2i_PKCS7(NULL, &p, len); 209151937Sjkim 210151937SjkimAt this point p7 contains a valid PKCS7 structure of NULL if an error 211151937Sjkimoccurred. If an error occurred ERR_print_errors(bio) should give more 212151937Sjkiminformation. 213151937Sjkim 214151937SjkimThe reason for the temporary variable 'p' is that the ASN1 functions 215151937Sjkimincrement the passed pointer so it is ready to read or write the next 216151937Sjkimstructure. This is often a cause of problems: without the temporary 217151937Sjkimvariable the buffer pointer is changed to point just after the data 218151937Sjkimthat has been read or written. This may well be uninitialized data 219151937Sjkimand attempts to free the buffer will have unpredictable results 220151937Sjkimbecause it no longer points to the same address. 221151937Sjkim 222151937Sjkim 223151937Sjkim* I've tried using <M_some_evil_pkcs12_macro> and I get errors why? 224151937Sjkim 225151937SjkimThis usually happens when you try compiling something using the PKCS#12 226151937Sjkimmacros with a C++ compiler. There is hardly ever any need to use the 227151937SjkimPKCS#12 macros in a program, it is much easier to parse and create 228151937SjkimPKCS#12 files using the PKCS12_parse() and PKCS12_create() functions 229151937Sjkimdocumented in doc/openssl.txt and with examples in demos/pkcs12. The 230151937Sjkim'pkcs12' application has to use the macros because it prints out 231151937Sjkimdebugging information. 232151937Sjkim 233151937Sjkim 234151937Sjkim* I've called <some function> and it fails, why? 235151937Sjkim 236151937SjkimBefore submitting a report or asking in one of the mailing lists, you 237151937Sjkimshould try to determine the cause. In particular, you should call 238151937SjkimERR_print_errors() or ERR_print_errors_fp() after the failed call 239151937Sjkimand see if the message helps. Note that the problem may occur earlier 240151937Sjkimthan you think -- you should check for errors after every call where 241151937Sjkimit is possible, otherwise the actual problem may be hidden because 242151937Sjkimsome OpenSSL functions clear the error state. 243151937Sjkim 244151937Sjkim 245151937Sjkim* I just get a load of numbers for the error output, what do they mean? 246151937Sjkim 247151937SjkimThe actual format is described in the ERR_print_errors() manual page. 248151937SjkimYou should call the function ERR_load_crypto_strings() before hand and 249151937Sjkimthe message will be output in text form. If you can't do this (for example 250151937Sjkimit is a pre-compiled binary) you can use the errstr utility on the error 251151937Sjkimcode itself (the hex digits after the second colon). 252151937Sjkim 253151937Sjkim 254151937Sjkim* Why do I get errors about unknown algorithms? 255151937Sjkim 256151937SjkimThis can happen under several circumstances such as reading in an 257151937Sjkimencrypted private key or attempting to decrypt a PKCS#12 file. The cause 258151937Sjkimis forgetting to load OpenSSL's table of algorithms with 259151937SjkimOpenSSL_add_all_algorithms(). See the manual page for more information. 260151937Sjkim 261151937Sjkim 262151937Sjkim* How do I create certificates or certificate requests? 263151937Sjkim 264151937SjkimCheck out the CA.pl(1) manual page. This provides a simple wrapper round 265151937Sjkimthe 'req', 'verify', 'ca' and 'pkcs12' utilities. For finer control check 266151937Sjkimout the manual pages for the individual utilities and the certificate 267151937Sjkimextensions documentation (currently in doc/openssl.txt). 268151937Sjkim 269151937Sjkim 270151937Sjkim* Why can't I create certificate requests? 271151937Sjkim 272151937SjkimYou typically get the error: 273151937Sjkim 274151937Sjkim unable to find 'distinguished_name' in config 275151937Sjkim problems making Certificate Request 276151937Sjkim 277151937SjkimThis is because it can't find the configuration file. Check out the 278151937SjkimDIAGNOSTICS section of req(1) for more information. 279151937Sjkim 280151937Sjkim 281151937Sjkim* Why does <SSL program> fail with a certificate verify error? 282151937Sjkim 283151937SjkimThis problem is usually indicated by log messages saying something like 284151937Sjkim"unable to get local issuer certificate" or "self signed certificate". 285151937SjkimWhen a certificate is verified its root CA must be "trusted" by OpenSSL 286151937Sjkimthis typically means that the CA certificate must be placed in a directory 287151937Sjkimor file and the relevant program configured to read it. The OpenSSL program 288151937Sjkim'verify' behaves in a similar way and issues similar error messages: check 289151937Sjkimthe verify(1) program manual page for more information. 290151937Sjkim 291151937Sjkim 292151937Sjkim* Why can I only use weak ciphers when I connect to a server using OpenSSL? 293151937Sjkim 294151937SjkimThis is almost certainly because you are using an old "export grade" browser 295151937Sjkimwhich only supports weak encryption. Upgrade your browser to support 128 bit 296151937Sjkimciphers. 297151937Sjkim 298151937Sjkim 299151937Sjkim* How can I create DSA certificates? 300151937Sjkim 301151937SjkimCheck the CA.pl(1) manual page for a DSA certificate example. 302151937Sjkim 303151937Sjkim 304151937Sjkim* Why can't I make an SSL connection to a server using a DSA certificate? 305151937Sjkim 306151937SjkimTypically you'll see a message saying there are no shared ciphers when 307151937Sjkimthe same setup works fine with an RSA certificate. There are two possible 308151937Sjkimcauses. The client may not support connections to DSA servers most web 309151937Sjkimbrowsers (including Netscape and MSIE) only support connections to servers 310151937Sjkimsupporting RSA cipher suites. The other cause is that a set of DH parameters 311151937Sjkimhas not been supplied to the server. DH parameters can be created with the 312151937Sjkimdhparam(1) command and loaded using the SSL_CTX_set_tmp_dh() for example: 313151937Sjkimcheck the source to s_server in apps/s_server.c for an example. 314151937Sjkim 315151937Sjkim 316151937Sjkim* How can I remove the passphrase on a private key? 317151937Sjkim 318151937SjkimFirstly you should be really *really* sure you want to do this. Leaving 319151937Sjkima private key unencrypted is a major security risk. If you decide that 320151937Sjkimyou do have to do this check the EXAMPLES sections of the rsa(1) and 321151937Sjkimdsa(1) manual pages. 322151937Sjkim 323151937Sjkim 324151937Sjkim* Why can't the OpenSSH configure script detect OpenSSL? 325151937Sjkim 326151937SjkimThere is a problem with OpenSSH 1.2.2p1, in that the configure script 327151937Sjkimcan't find the installed OpenSSL libraries. The problem is actually 328151937Sjkima small glitch that is easily solved with the following patch to be 329151937Sjkimapplied to the OpenSSH distribution: 330151937Sjkim 331151937Sjkim----- snip:start ----- 332151937Sjkim--- openssh-1.2.2p1/configure.in.orig Thu Mar 23 18:56:58 2000 333151937Sjkim+++ openssh-1.2.2p1/configure.in Thu Mar 23 18:55:05 2000 334151937Sjkim@@ -152,10 +152,10 @@ 335151937Sjkim AC_MSG_CHECKING([for OpenSSL/SSLeay directory]) 336151937Sjkim for ssldir in "" $tryssldir /usr /usr/local/openssl /usr/lib/openssl /usr/local/ssl /usr/lib/ssl /usr/local /usr/pkg /opt /opt/openssl ; do 337151937Sjkim if test ! -z "$ssldir" ; then 338151937Sjkim- LIBS="$saved_LIBS -L$ssldir" 339151937Sjkim+ LIBS="$saved_LIBS -L$ssldir/lib" 340151937Sjkim CFLAGS="$CFLAGS -I$ssldir/include" 341151937Sjkim if test "x$need_dash_r" = "x1" ; then 342151937Sjkim- LIBS="$LIBS -R$ssldir" 343151937Sjkim+ LIBS="$LIBS -R$ssldir/lib" 344151937Sjkim fi 345151937Sjkim fi 346151937Sjkim LIBS="$LIBS -lcrypto" 347151937Sjkim--- openssh-1.2.2p1/configure.orig Thu Mar 23 18:55:02 2000 348151937Sjkim+++ openssh-1.2.2p1/configure Thu Mar 23 18:57:08 2000 349151937Sjkim@@ -1890,10 +1890,10 @@ 350151937Sjkim echo "configure:1891: checking for OpenSSL/SSLeay directory" >&5 351151937Sjkim for ssldir in "" $tryssldir /usr /usr/local/openssl /usr/lib/openssl /usr/local/ssl /usr/lib/ssl /usr/local /usr/pkg /opt /opt/openssl ; do 352151937Sjkim if test ! -z "$ssldir" ; then 353151937Sjkim- LIBS="$saved_LIBS -L$ssldir" 354151937Sjkim+ LIBS="$saved_LIBS -L$ssldir/lib" 355151937Sjkim CFLAGS="$CFLAGS -I$ssldir/include" 356151937Sjkim if test "x$need_dash_r" = "x1" ; then 357151937Sjkim- LIBS="$LIBS -R$ssldir" 358151937Sjkim+ LIBS="$LIBS -R$ssldir/lib" 359151937Sjkim fi 360151937Sjkim fi 361151937Sjkim LIBS="$LIBS -lcrypto" 362151937Sjkim----- snip:end ----- 363151937Sjkim 364151937Sjkim 365151937Sjkim* Why does the OpenSSL test fail with "bc: command not found"? 366151937Sjkim 367151937SjkimYou didn't install "bc", the Unix calculator. If you want to run the 368151937Sjkimtests, get GNU bc from ftp://ftp.gnu.org or from your OS distributor. 369151937Sjkim 370151937Sjkim 371151937Sjkim* Why does the OpenSSL test fail with "bc: 1 no implemented"? 372151937Sjkim 373151937SjkimOn some SCO installations or versions, bc has a bug that gets triggered when 374151937Sjkimyou run the test suite (using "make test"). The message returned is "bc: 375151937Sjkim1 not implemented". The best way to deal with this is to find another 376151937Sjkimimplementation of bc and compile/install it. For example, GNU bc (see 377151937Sjkimhttp://www.gnu.org/software/software.html for download instructions) can 378151937Sjkimbe safely used. 379151937Sjkim 380151937Sjkim 381151937Sjkim* Why does the OpenSSL compilation fail on Alpha True64 Unix? 382151937Sjkim 383151937SjkimOn some Alpha installations running True64 Unix and Compaq C, the compilation 384151937Sjkimof crypto/sha/sha_dgst.c fails with the message 'Fatal: Insufficient virtual 385151937Sjkimmemory to continue compilation.' As far as the tests have shown, this may be 386151937Sjkima compiler bug. What happens is that it eats up a lot of resident memory 387151937Sjkimto build something, probably a table. The problem is clearly in the 388151937Sjkimoptimization code, because if one eliminates optimization completely (-O0), 389151937Sjkimthe compilation goes through (and the compiler consumes about 2MB of resident 390151937Sjkimmemory instead of 240MB or whatever one's limit is currently). 391151937Sjkim 392151937SjkimThere are three options to solve this problem: 393151937Sjkim 394151937Sjkim1. set your current data segment size soft limit higher. Experience shows 395151937Sjkimthat about 241000 kbytes seems to be enough on an AlphaServer DS10. You do 396151937Sjkimthis with the command 'ulimit -Sd nnnnnn', where 'nnnnnn' is the number of 397151937Sjkimkbytes to set the limit to. 398151937Sjkim 399151937Sjkim2. If you have a hard limit that is lower than what you need and you can't 400151937Sjkimget it changed, you can compile all of OpenSSL with -O0 as optimization 401151937Sjkimlevel. This is however not a very nice thing to do for those who expect to 402151937Sjkimget the best result from OpenSSL. A bit more complicated solution is the 403151937Sjkimfollowing: 404151937Sjkim 405151937Sjkim----- snip:start ----- 406151937Sjkim make DIRS=crypto SDIRS=sha "`grep '^CFLAG=' Makefile.ssl | \ 407151937Sjkim sed -e 's/ -O[0-9] / -O0 /'`" 408151937Sjkim rm `ls crypto/*.o crypto/sha/*.o | grep -v 'sha_dgst\.o'` 409151937Sjkim make 410151937Sjkim----- snip:end ----- 411151937Sjkim 412151937SjkimThis will only compile sha_dgst.c with -O0, the rest with the optimization 413151937Sjkimlevel chosen by the configuration process. When the above is done, do the 414151937Sjkimtest and installation and you're set. 415151937Sjkim 416151937Sjkim 417151937Sjkim* Why does the OpenSSL compilation fail with "ar: command not found"? 418151937Sjkim 419151937SjkimGetting this message is quite usual on Solaris 2, because Sun has hidden 420151937Sjkimaway 'ar' and other development commands in directories that aren't in 421151937Sjkim$PATH by default. One of those directories is '/usr/ccs/bin'. The 422151937Sjkimquickest way to fix this is to do the following (it assumes you use sh 423151937Sjkimor any sh-compatible shell): 424151937Sjkim 425151937Sjkim----- snip:start ----- 426151937Sjkim PATH=${PATH}:/usr/ccs/bin; export PATH 427151937Sjkim----- snip:end ----- 428151937Sjkim 429151937Sjkimand then redo the compilation. What you should really do is make sure 430151937Sjkim'/usr/ccs/bin' is permanently in your $PATH, for example through your 431151937Sjkim'.profile' (again, assuming you use a sh-compatible shell). 432151937Sjkim 433151937Sjkim