This is non-trivial [1] and so should be a separate task outside of regular package update crunch. Initial recipe is here [2] [1] http://lists.openembedded.org/pipermail/openembedded-core/2016-December/130132.html [2] https://git.yoctoproject.org/cgit/cgit.cgi/poky-contrib/log/?h=akanavin/openssl-1.1
At present, we expect we will still need the 1.0.x version of OpenSSL. This is due to various issues like the FIPS-140-2 module, as well as the EOL policy for 1.1 is shorter then the current 1.0.2.
Openssl 1.0 will be provided for as long as it's supported upstream, but it will not be the default. If you want or need 1.0, the recipe should explictly ask for it (DEPENDS = "openssl10"). Openssl 1.1 will be updated again to a newer not-yet-released version before it goes out of support. Can you review and test the patchset please? It's basically ready, and is held up only by u-boot still stuck at 1.0 (they have incomplete patches, which they can't quite finish off). Due to dependency chains this causes a file conflict with 1.1.
I think this new logcheck warning is from the ssl upgrade: [log_check] WARNING: StartCom_Certification_Authority.pem does not contain a certificate or CRL: skipping