#1149726 lighttpd-mod-mbedtls: Since one particular update to mbedtls (aka Polar SSL) libraries they are no longer compatible with lighttpd-mod-mbedtls. Which causes Lighttpd with lighttpd-mod-mbedtls to crash when mod_mbedtls is used. #1149726
- Package:
- lighttpd-mod-mbedtls
- Source:
- lighttpd-mod-mbedtls
- Description:
- TLS support using mbedTLS module for lighttpd
- Submitter:
- Anonymous
- Date:
- 2026-10-21 14:39:01 UTC
- Severity:
- normal
Dear Maintainer, Since one particular update to mbedtls (aka Polar SSL) libraries they are no longer compatible with lighttpd-mod-mbedtls. Which causes Lighttpd with lighttpd-mod-mbedtls to crash. Here is output of gdb debugger: (gdb) run Starting program: /usr/sbin/lighttpd -D -f /etc/lighttpd/lighttpd.conf [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Program received signal SIGSEGV, Segmentation fault. 0x0000000000000000 in ?? () (gdb) (gdb) bt #0 0x0000000000000000 in ?? () #1 0x00007ff69596a455 in ?? () from /lib/x86_64-linux-gnu/libmbedcrypto.so.16 #2 0x00007ff69596a85c in mbedtls_ctr_drbg_random_with_add () from /lib/x86_64-linux-gnu/libmbedcrypto.so.16 #3 0x00007ff69596aaa3 in mbedtls_ctr_drbg_random () from /lib/x86_64-linux-gnu/libmbedcrypto.so.16 #4 0x00007ff69596288d in mbedtls_mpi_core_fill_random () from /lib/x86_64-linux-gnu/libmbedcrypto.so.16 #5 0x00007ff69596298f in mbedtls_mpi_core_random () from /lib/x86_64-linux-gnu/libmbedcrypto.so.16 #6 0x00007ff6959723a5 in ?? () from /lib/x86_64-linux-gnu/libmbedcrypto.so.16 #7 0x00007ff695972965 in ?? () from /lib/x86_64-linux-gnu/libmbedcrypto.so.16 #8 0x00007ff6959741ef in mbedtls_ecp_mul () from /lib/x86_64-linux-gnu/libmbedcrypto.so.16 #9 0x00007ff695974a97 in mbedtls_ecp_check_pub_priv () from /lib/x86_64-linux-gnu/libmbedcrypto.so.16 #10 0x00007ff695a3df16 in ?? () from /usr/lib/lighttpd/mod_mbedtls.so #11 0x00007ff695a3f898 in ?? () from /usr/lib/lighttpd/mod_mbedtls.so #12 0x00005603410e9f39 in plugins_call_init () #13 0x00005603410d62a1 in ?? () #14 0x00005603410d728a in main ()
Some further information from gdb
root@web-server:/etc/lighttpd# gdb --args lighttpd -D -f /etc/lighttpd/lighttpd.conf
GNU gdb (Debian 16.3-1) 16.3
Copyright (C) 2024 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from lighttpd...
(No debugging symbols found in lighttpd)
(gdb) run
Starting program: /usr/sbin/lighttpd -D -f /etc/lighttpd/lighttpd.conf
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Program received signal SIGSEGV, Segmentation fault.
0x0000000000000000 in ?? ()
(gdb) bt full
#0 0x0000000000000000 in ?? ()
No symbol table info available.
#1 0x00007fc5eb12a455 in ?? () from /lib/x86_64-linux-gnu/libmbedcrypto.so.16
No symbol table info available.
#2 0x00007fc5eb12a85c in mbedtls_ctr_drbg_random_with_add () from /lib/x86_64-linux-gnu/libmbedcrypto.so.16
No symbol table info available.
#3 0x00007fc5eb12aaa3 in mbedtls_ctr_drbg_random () from /lib/x86_64-linux-gnu/libmbedcrypto.so.16
No symbol table info available.
#4 0x00007fc5eb12288d in mbedtls_mpi_core_fill_random () from /lib/x86_64-linux-gnu/libmbedcrypto.so.16
No symbol table info available.
#5 0x00007fc5eb12298f in mbedtls_mpi_core_random () from /lib/x86_64-linux-gnu/libmbedcrypto.so.16
No symbol table info available.
#6 0x00007fc5eb1323a5 in ?? () from /lib/x86_64-linux-gnu/libmbedcrypto.so.16
No symbol table info available.
#7 0x00007fc5eb132965 in ?? () from /lib/x86_64-linux-gnu/libmbedcrypto.so.16
No symbol table info available.
#8 0x00007fc5eb1341ef in mbedtls_ecp_mul () from /lib/x86_64-linux-gnu/libmbedcrypto.so.16
No symbol table info available.
#9 0x00007fc5eb134a97 in mbedtls_ecp_check_pub_priv () from /lib/x86_64-linux-gnu/libmbedcrypto.so.16
No symbol table info available.
#10 0x00007fc5eb1fdf16 in ?? () from /usr/lib/lighttpd/mod_mbedtls.so
No symbol table info available.
#11 0x00007fc5eb1ff898 in ?? () from /usr/lib/lighttpd/mod_mbedtls.so
No symbol table info available.
#12 0x000055ff64f12f39 in plugins_call_init ()
No symbol table info available.
#13 0x000055ff64eff2a1 in ?? ()
No symbol table info available.
#14 0x000055ff64f0028a in main ()
No symbol table info available.
(gdb) info registers
rax 0x0 0
rbx 0x55ff96f68920 94556237760800
rcx 0x0 0
rdx 0x0 0
rsi 0x7fff17234080 140733581574272
rdi 0x0 0
rbp 0x7fff17234080 0x7fff17234080
rsp 0x7fff17234078 0x7fff17234078
r8 0x0 0
r9 0x0 0
r10 0x55ff96f51010 94556237664272
r11 0x7fc5eb71dac0 140488035392192
r12 0x0 0
r13 0x0 0
r14 0x0 0
r15 0x20 32
rip 0x0 0x0
eflags 0x10202 [ IF RF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
fs_base 0x7fc5eb5370c0 140488033398976
gs_base 0x0 0
(gdb) x/i $pc
=> 0x0: Cannot access memory at address 0x0
(gdb) frame 2
#2 0x00007fc5eb12a85c in mbedtls_ctr_drbg_random_with_add () from /lib/x86_64-linux-gnu/libmbedcrypto.so.16
(gdb) info registers
rax 0x0 0
rbx 0x0 0
rcx 0x0 0
rdx 0x0 0
rsi 0x7fff17234080 140733581574272
rdi 0x0 0
rbp 0x7fff17234260 0x7fff17234260
rsp 0x7fff17234250 0x7fff17234250
r8 0x0 0
r9 0x0 0
r10 0x55ff96f51010 94556237664272
r11 0x7fc5eb71dac0 140488035392192
r12 0x55ff96f68920 94556237760800
r13 0x20 32
r14 0x55ff96f69420 94556237763616
r15 0x20 32
rip 0x7fc5eb12a85c 0x7fc5eb12a85c <mbedtls_ctr_drbg_random_with_add+124>
eflags 0x10202 [ IF RF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
fs_base 0x7fc5eb5370c0 140488033398976
gs_base 0x0 0
(gdb) frame 2
#2 0x00007fc5eb12a85c in mbedtls_ctr_drbg_random_with_add () from /lib/x86_64-linux-gnu/libmbedcrypto.so.16
(gdb) info locals
No symbol table info available.
Thank you for your report. This reminds me of a fix in lighttpd 1.4.82 almost a year ago. https://github.com/lighttpd/lighttpd1.4/commit/37fe7397bc24c710437bef5f58cda87bd49f3d0b Do these seem similar to your issue? https://redmine.lighttpd.net/boards/2/topics/12097 https://redmine.lighttpd.net/issues/3288 Cheers, Glenn
Hello Mr. Strauss My technical experience does not reach very deep, however here are types of my certificates if that helps. Signature Algorithm: ecdsa-with-SHA384 Public Key Algorithm: id-ecPublicKey ASN1 OID: prime256v1 NIST CURVE: P-256 They are the new IP Based certificates from Letsencrypt generated trough certbot. https://letsencrypt.org/2026/01/15/6day-and-ip-general-availability Thank you for your time, Anon
certificate Message-Id: <20261006122846.15e9c535c4be7a9d710845ff@wo.cz> X-Mailer: Sylpheed 3.8.0beta1 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Good morning. After I changed certificate types in certbot to --key-type rsa the lighttpd with mbedtls module no longer crashes at startup and works normaly. Thus confirming the problem is with ecdsa. Anon.
Hello. What is the status of this issue, did you acknowledged this as bug. If so do you plan to fix it or "WONTFIX" ? Anon
Dear MIA can you look into this issue, there seems to be no activity. Thank you.
A fix is in progress and I plan to release it next week, though I will need some help from a DD for backports.