OpenSSL gone

Questions
1

I noticed that recent Docker images have removed OpenSSL. Could you please consider adding it back?

While many users may not need OpenSSL directly, it is essential for many real-world systems that perform security verification. For example, the LINE Messaging API requires OpenSSL to verify the authenticity of webhook requests.

Since OpenSSL has been removed, users have to reinstall it manually after every image update, which is both inconvenient and time-consuming. Considering that OpenSSL adds very little to the overall container size, I would greatly appreciate it if you could include it again in the next release.

Thank you for your consideration.

2

Hi @kirkchu Welcome!
LINE webhook verification is just Base64(HMAC-SHA256(channel_secret, raw_body)) compared against the x-line-signature header, and n8n computes that with the built-in Crypto node. That node uses Node’s own bundled crypto library, not the system openssl package, so the dropped binary doesn’t affect it and there’s nothing to reinstall after an image update.
Turn on “Raw Body” in the Webhook node first, since LINE hashes the exact bytes and a re-parsed JSON body won’t match. Then add a Crypto node set to Action Hmac, Type SHA256, Value {{ $json.rawBody }}, Secret your channel secret, Encoding BASE64, and compare its output to {{ $json.headers[“x-line-signature”] }} in an IF node.
If you need the openssl binary for something outside n8n, bake it into your own image so it survives updates:

FROM n8nio/n8n
USER root
RUN apk add --no-cache openssl
USER node
3

Thank you! It works now.

I made a slight improvement to your approach as follows:

  • Action: Hmac

  • Credential: In Hmac Secret, enter your Channel Secret. Leave all other fields blank.

  • Type: SHA256

  • Value: {{ $('Webhook').item.json.body.toJsonString() }}

  • Encoding: BASE64

Also, there’s no need to enable “Raw Body” in the Webhook node. I think it’s better to leave the Webhook node unchanged unless there’s a specific reason to modify it.

4

@kirkchu glad it helped, can you consider marking that as a solution :smiley: