The terminal froze. My deploy was stuck. The culprit was OpenSSL in Zsh.

The terminal froze. My deploy was stuck. The culprit was OpenSSL in Zsh.

When your shell, environment variables, and cryptographic libraries don’t play well together, seconds turn into hours. OpenSSL is battle-tested, but in Zsh, misconfigurations can surface in subtle, maddening ways—wrong paths, missing symlinks, conflicting versions. The fixes are never glamorous, but they matter.

The key is knowing how OpenSSL interacts with Zsh’s environment loading. Zsh reads startup files like .zshrc, .zprofile, and .zlogin—each with its own scope. A misplaced export PATH or a leftover alias from an old brew install can break every SSL handshake in your workflow. Before you blame the tool, confirm which binary runs with:

which openssl
openssl version -a

If you see an unexpected path—especially one tied to system defaults instead of your intended brew or custom build—strip out the conflict. Update PATH early in .zshrc:

export PATH="/usr/local/opt/openssl@3/bin:$PATH"
export LDFLAGS="-L/usr/local/opt/openssl@3/lib"
export CPPFLAGS="-I/usr/local/opt/openssl@3/include"

Then reload:

source ~/.zshrc

If you compile software against OpenSSL, verify that pkg-config points to the correct version:

pkg-config --modversion openssl

Zsh’s autocompletion and path hashing can cache wrong locations. Clear with:

rehash

Sometimes you inherit a repo with brittle TLS builds. The maintainer might have hardcoded a system library path from years ago. Swap it, test it, and confirm certificates with:

openssl s_client -connect example.com:443

Behind all this, the goal is stability. A predictable shell and a consistent OpenSSL install save hours over the life of a project. Small fixes compound. When Zsh, OpenSSL, and your build toolchain align, the pipeline flows. No SSL errors, no blocked deploys, no silent handshake timeouts.

You can create that reliability fast. See it live in minutes with hoop.dev and watch your workflows stay clean from local to production.