Statically link OpenSSL in releases
In some cases, such as RedHat not including ECC curves in OpenSSL in Fedora, RHEL and CentOS (+ possibly derivatives such as Rocky Linux ?), the OpenSSL version on the host system is not compatible with the version with which Erlang is built, and on which Mobilizon releases are built.
https://github.com/kerl/kerl#compiling-crypto-on-red-hat-systems
It's possible we'll see the same kind of issue when Erlang builds by default against OpenSSL 3.0, which might be incompatible with the host system's 1.x versions.
A workaround in this situation is to install Mobilizon from source, where an appropriate local Erlang version will be used, compatible with the local OpenSSL version. People can also simply use the Docker install.
OpenSSL static linking
In the future, we should try to have a look if we can statically link OpenSSL to Erlang to avoid this kind of trouble (and possibly more). However this requires rebuilding all of OpenSSL, Erlang, Elixir and Mobilizon itself for all supported platforms, so this will take a very long time.
Building OpenSSL
./Configure --prefix=/usr/local/ssl --openssldir=/usr/local/ssl shared
make && make install
Building Erlang
KERL_CONFIGURE_OPTIONS="--with-ssl=/usr/local/ssl/ --disable-dynamic-ssl-lib"
- https://erlang.org/pipermail/erlang-questions/2012-November/070406.html
- https://stackoverflow.com/a/6646351
Disabling Elliptic Curves
Another solution would be to disable Elliptic Curves altogether for Mobilizon with the following Erlang compilation option, but it would be sad to disable that just because RedHat is fearful on the topic.
CFLAGS="-DOPENSSL_NO_EC=1"
Note: It seems the following might be enough (only disabling curves unavailable in RH-based distros) to keep a kinda-working modern SSL environment.
CFLAGS="-DOPENSSL_NO_EC2M=1"
- https://github.com/kerl/kerl/issues/279#issuecomment-451663685
- https://github.com/erlang/otp/issues/3962#issuecomment-776577256