Documentation implies support for openssl 3 (SSL/TLS – Knowledge Base – kdb+ and q documentation - kdb+ and q documentation)
However (OSX ARM) KDB-X doesn’t seem to search for libssl.3.dylib
q)(-26!)
'Could not initialize openssl. Error was dlopen(libssl.1.1.dylib, 0x0002): tried: 'libssl.1.1.dylib' (no such file), '/System/Volumes/Preboot/Cryptexes/OSlibssl.1.1.dylib' (no such file), '/usr/lib/libssl.1.1.dylib' (no such file, not in dyld cache), 'libs
[0] (-26!)
In the interests of increasing adoption of KDB, it may help users to make the process of setting up client https connections easier; I would propose a feature request.
1 Answer
1
After ensuring openssl is installed: brew install openssl
The library can be seen in:
❱ ls /opt/homebrew/lib/libssl*
/opt/homebrew/lib/libssl.3.dylib /opt/homebrew/lib/libssl.a /opt/homebrew/lib/libssl.dylib
We can make this available to q:
export DYLD_FALLBACK_LIBRARY_PATH="$DYLD_FALLBACK_LIBRARY_PATH:/opt/homebrew/lib/"
And verify it:
q)(-26!)[]
SSLEAY_VERSION | OpenSSL 3.5.2 5 Aug 2025
SSL_CERT_FILE | /opt/homebrew/etc/openssl@3/server-crt.pem
SSL_CA_CERT_FILE | /opt/homebrew/etc/openssl@3/cacert.pem
SSL_CA_CERT_PATH | /opt/homebrew/etc/openssl@3
SSL_KEY_FILE | /opt/homebrew/etc/openssl@3/server-key.pem
SSL_CIPHER_LIST | ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-EC..
SSL_VERIFY_CLIENT| NO
SSL_VERIFY_SERVER| YES
q)
Great, thanks for this, got me a step closer! My (-26!)[] output matches yours, but I still experience (I've shortened the error message to fit). Does https actually work for you? q).Q.hg "https://gamma-api.polymarket.com/series?categories_labels=bitcoin" 005F38F601000000:error:80000002:system library:file_ctrl:No such file or directory:crypto/bio/bss_file.c:288:calling fopen(/opt/homebrew/etc/openssl@3/server-crt.pem, r) 'conn. OS reports: Protocol not available [0] .Q.hg "https://gamma-api.polymarket.com/series?categories_labels=bitcoin"
– chris12See https://code.kx.com/q/kb/ssl/#tls-client-mode it means the certs do not exist or cannot be read. If you don't wish to verify a server’s certificate, set
– rocuinneagainexport SSL_VERIFY_SERVER=NObefore starting q, then it will run.