Do not use the pre-1.1 workaround for LibreSSL. Index: pbkdf2.c --- pbkdf2.c.orig +++ pbkdf2.c @@ -53,7 +53,7 @@ int fallback_pkcs5_pbkdf2_hmac(const char *pass, size_ unsigned char tmp_md[md_len]; -#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) +#if OPENSSL_VERSION_NUMBER < 0x10100000L HMAC_CTX real_ctx; ctx = &real_ctx; HMAC_CTX_init(ctx); @@ -97,7 +97,7 @@ int fallback_pkcs5_pbkdf2_hmac(const char *pass, size_ ret = 1; ERR_LABEL -#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) +#if OPENSSL_VERSION_NUMBER < 0x10100000L HMAC_CTX_cleanup(ctx); #else HMAC_CTX_free(ctx);