How to enable verbose OpenSSL error messages

[itsManjeet]

Hi team,

I’m currently working with libspdm for TPM support and using the OpenSSL crypto library backend. When an OpenSSL-related error occurs, the logs only show numeric error codes and not the detailed, human-readable error strings.

For example, when calling ERR_print_errors , I get output like this:

00000000:error:068000E0:asn1 encoding routines:ASN1_get_object:reason(224)::0:
00000000:error:068000E0:asn1 encoding routines:ASN1_get_object:reason(224)::0:
00000000:error:068000E0:asn1 encoding routines:ASN1_get_object:reason(224)::0:
00000000:error:068000E0:asn1 encoding routines:ASN1_get_object:reason(224)::0:

What I’ve tried:

• Disabled the OPENSSL_NO_ERR flag in libspdm/os_stub/openssllib/include/openssl/configuration.h (to ensure the error string tables aren’t excluded at compile time)

It seems that the OpenSSL error strings (e.g., the detailed “reason” text) are not being properly loaded or printed.

Question:
Is there a recommended way within libspdm to enable verbose OpenSSL error messages, or to ensure that ERR_load_*_strings() or similar initialization calls are made?

Environment:

libspdm version:	bf16652ead0ad03c5406cbe2cb3e8826d19e5c79
Crypto backend:	OpenSSL
Platform:	Linux/aarch64

[steven-bellock]

My uneducated guess is that, because libspdm uses the UEFI profile of OpenSSL, -DOPENSSL_SYS_UEFI=1, then that might affect logging / messages.

• https://github.com/openssl/openssl/blob/f2917ee0e0b9e5dd34a6a6be8aaca0fe7a64c8a6/include/internal/e_os.h#L25-L28
• https://github.com/openssl/openssl/blob/master/crypto/bio/bss_log.c

[itsManjeet]

Apologies for the delayed response. I have tried enabling the UEFI profile of OpenSSL with -DOPENSSL_SYS_UEFI=1, but unfortunately, it did not resolve the issue.
In OpenSSL 1.x, there are some err_load_strings APIs that need to be explicitly loaded before error messages can be properly displayed. However, in OpenSSL 3.x, this step is no longer required. I have tested both approaches, but neither seemed to work as expected in this case.
For now, I am mapping the error codes manually from os_stub/openssllib/openssl/crypto/<module>/<module>_err.c as a temporary workaround.