Nginx's error log shows some OpenSSL Handshake errors and while searching for the cause I found confusing outputs of what OpenSSL version is used.Details:Debian Jessie 8.7 64 Bit# apt-cache policy opensslopenssl:  Installed: 1.0.1t-1+deb8u6  Candidate: 1.0.1t-1+deb8u6  Version table:     1.0.2k-1~bpo8+1 0        100 http://ftp.debian.org/debian/ jessie-backports/main amd64 Packages *** 1.0.1t-1+deb8u6 0        500 http://security.debian.org/ jessie/updates/main amd64 Packages        100 /var/lib/dpkg/status     1.0.1t-1+deb8u5 0        500 http://mirror.hetzner.de/debian/packages/ jessie/main amd64 Packages        500 http://http.debian.net/debian/ jessie/main amd64 Packages# apt-cache policy nginxnginx:  Installed: 1.9.10-1~bpo8+4  Candidate: 1.10.3-1~bpo8+1  Version table:     1.10.3-1~bpo8+1 0        100 http://ftp.debian.org/debian/ jessie-backports/main amd64 Packages *** 1.9.10-1~bpo8+4 0        100 /var/lib/dpkg/status     1.6.2-5+deb8u4 0        500 http://mirror.hetzner.de/debian/packages/ jessie/main amd64 Packages        500 http://http.debian.net/debian/ jessie/main amd64 Packages        500 http://security.debian.org/ jessie/updates/main amd64 Packages# nginx -Vnginx version: nginx/1.9.10built with OpenSSL 1.0.2j  26 Sep 2016 (running with OpenSSL 1.0.2k  26 Jan 2017)# openssl version -aOpenSSL 1.0.1t  3 May 2016 (Library: OpenSSL 1.0.2k  26 Jan 2017)How can nginx runs with openssl 1.0.2k and openssl version -a says that the Library is OpenSSL 1.0.2k but apt-cache policy openssl says installed is 1.0.1t ?Could someone shed some light, please?
How to distinguish which version of OpenSSL is installed?
debian;openssl;nginx
The openssl package contains the front-end binary, not the library. You're tracking Jessie for that package (with its security updates).The library itself is libssl1.0.0, and you're tracking Jessie backports for that package (along with Nginx; you're just a few versions behind for the latter). This is what Nginx uses, and is the library version identified by the openssl front-end. You can see the version of the library on your system withapt-cache policy libssl1.0.0(as well as the availability of newer versions, if any).