KDB-X Open SSL support

Documentation implies support for openssl 3 (SSL/TLS – Knowledge Base – kdb+ and q documentation - kdb+ and q documentation)

However (OSX ARM) KDB-X doesn’t seem to search for libssl.3.dylib

q)(-26!)
'Could not initialize openssl. Error was dlopen(libssl.1.1.dylib, 0x0002): tried: 'libssl.1.1.dylib' (no such file), '/System/Volumes/Preboot/Cryptexes/OSlibssl.1.1.dylib' (no such file), '/usr/lib/libssl.1.1.dylib' (no such file, not in dyld cache), 'libs
[0] (-26!)

In the interests of increasing adoption of KDB, it may help users to make the process of setting up client https connections easier; I would propose a feature request.

1 Answer

1

After ensuring openssl is installed: brew install openssl

The library can be seen in:

❱ ls /opt/homebrew/lib/libssl*
/opt/homebrew/lib/libssl.3.dylib /opt/homebrew/lib/libssl.a       /opt/homebrew/lib/libssl.dylib

We can make this available to q:

export DYLD_FALLBACK_LIBRARY_PATH="$DYLD_FALLBACK_LIBRARY_PATH:/opt/homebrew/lib/"  

And verify it:

q)(-26!)[]
SSLEAY_VERSION   | OpenSSL 3.5.2 5 Aug 2025
SSL_CERT_FILE    | /opt/homebrew/etc/openssl@3/server-crt.pem
SSL_CA_CERT_FILE | /opt/homebrew/etc/openssl@3/cacert.pem
SSL_CA_CERT_PATH | /opt/homebrew/etc/openssl@3
SSL_KEY_FILE     | /opt/homebrew/etc/openssl@3/server-key.pem
SSL_CIPHER_LIST  | ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-EC..
SSL_VERIFY_CLIENT| NO
SSL_VERIFY_SERVER| YES
q)

Great, thanks for this, got me a step closer! My (-26!)[] output matches yours, but I still experience (I've shortened the error message to fit). Does https actually work for you? q).Q.hg "https://gamma-api.polymarket.com/series?categories_labels=bitcoin" 005F38F601000000:error:80000002:system library:file_ctrl:No such file or directory:crypto/bio/bss_file.c:288:calling fopen(/opt/homebrew/etc/openssl@3/server-crt.pem, r) 'conn. OS reports: Protocol not available [0] .Q.hg "https://gamma-api.polymarket.com/series?categories_labels=bitcoin"

See https://code.kx.com/q/kb/ssl/#tls-client-mode it means the certs do not exist or cannot be read. If you don't wish to verify a server’s certificate, set export SSL_VERIFY_SERVER=NO before starting q, then it will run.