There are some incompatibilities with OpenSSL v1.1.0 and how we detects OCSP availability. Specifically, is no longer a #define, so it fails that check. However, removing that check (since that symbol is available in all versions we support AFAIK), I get these errors:
distcc[16332] ERROR: compile ../../../../trafficserver.git/iocore/net/OCSPStapling.cc on tintin.ogre.com/12,cpp,lzo failed
distcc[16332] (dcc_build_somewhere) Warning: remote compilation of '../../../../trafficserver.git/iocore/net/OCSPStapling.cc' failed, retrying locally
distcc[16332] (dcc_build_somewhere) Warning: failed to distribute and fallbacks are disabled
../../../../trafficserver.git/iocore/net/OCSPStapling.cc: In function ‘X509* stapling_get_issuer(SSL_CTX*, X509*)’:
../../../../trafficserver.git/iocore/net/OCSPStapling.cc:83:18: error: aggregate ‘X509_STORE_CTX inctx’ has incomplete type and cannot be defined
X509_STORE_CTX inctx;
^~~~~
../../../../trafficserver.git/iocore/net/OCSPStapling.cc:99:25: error: invalid use of incomplete type ‘X509 {aka struct x509_st}’
CRYPTO_add(&issuer->references, 1, CRYPTO_LOCK_X509);
^~
In file included from /usr/include/openssl/crypto.h:31:0,
from /usr/include/openssl/comp.h:16,
from /usr/include/openssl/ssl.h:47,
from ../../../../trafficserver.git/iocore/net/P_OCSPStapling.h:25,
from ../../../../trafficserver.git/iocore/net/OCSPStapling.cc:22:
/usr/include/openssl/ossl_typ.h:119:16: note: forward declaration of ‘X509 {aka struct x509_st}’
typedef struct x509_st X509;
^~~~~~~
../../../../trafficserver.git/iocore/net/OCSPStapling.cc:99:27: error: invalid use of incomplete type ‘X509 {aka struct x509_st}’
CRYPTO_add(&issuer->references, 1, CRYPTO_LOCK_X509);
^~~~~~~~~~
In file included from /usr/include/openssl/crypto.h:31:0,
from /usr/include/openssl/comp.h:16,
from /usr/include/openssl/ssl.h:47,
from ../../../../trafficserver.git/iocore/net/P_OCSPStapling.h:25,
from ../../../../trafficserver.git/iocore/net/OCSPStapling.cc:22:
/usr/include/openssl/ossl_typ.h:119:16: note: forward declaration of ‘X509 {aka struct x509_st}’
typedef struct x509_st X509;
^~~~~~~
../../../../trafficserver.git/iocore/net/OCSPStapling.cc:99:42: error: ‘CRYPTO_LOCK_X509’ was not declared in this scope
CRYPTO_add(&issuer->references, 1, CRYPTO_LOCK_X509);
^~~~~~~~~~~~~~~~
../../../../trafficserver.git/iocore/net/OCSPStapling.cc:99:42: note: suggested alternative: ‘CRYPTO_LOCK’
CRYPTO_add(&issuer->references, 1, CRYPTO_LOCK_X509);
^~~~~~~~~~~~~~~~
CRYPTO_LOCK
../../../../trafficserver.git/iocore/net/OCSPStapling.cc:99:7: error: ‘CRYPTO_add’ was not declared in this scope
CRYPTO_add(&issuer->references, 1, CRYPTO_LOCK_X509);
^~~~~~~~~~
../../../../trafficserver.git/iocore/net/OCSPStapling.cc:99:7: note: suggested alternative: ‘CRYPTO_ONCE’
CRYPTO_add(&issuer->references, 1, CRYPTO_LOCK_X509);
^~~~~~~~~~
CRYPTO_ONCE
gmake[2]: *** [Makefile:1038: OCSPStapling.o] Error 1
gmake[2]: *** Waiting for unfinished jobs....
gmake[2]: Leaving directory '/home/leif/apache/BUILDS/release/iocore/net'
gmake[1]: *** [Makefile:609: all-recursive] Error 1
gmake[1]: Leaving directory '/home/leif/apache/BUILDS/release/iocore'
gmake: *** [Makefile:843: all-recursive] Error 1
__________Shutting down distcc-pump include server
There are some incompatibilities with OpenSSL v1.1.0 and how we detects OCSP availability. Specifically, is no longer a #define, so it fails that check. However, removing that check (since that symbol is available in all versions we support AFAIK), I get these errors: