Reduce nginx size when compiled with openssl on embedded target - nginx

Question

I need to reduce the size of nginx when compiled with openssl on an embedded target.
I am able to compile the nginx with ssl using the steps given in the http://wiki.nginx.org/InstallOptions. It compiles well, but the problem I am facing its size, i.e nginx binary coming to almost 6MB.
Since I have to run the nginx on the embedded target, I tried cross compiling with for arm based board. I am to cross compile and the size is coming to 1.3MB for the target.
If I disable openssl and compile its coming to 400KB, I think nginx is statically linking the openssl .
If so how to dynamically include the openssl to nginx, because my target libs already has the support for crypto and ssl libs. I tried all the option but could not succeeded.

Answer 1

If so how to dynamically include the openssl to nginx
You need to specify OpenSSL with:
--with-http_ssl_module
The above command will effective link against the OpenSSL shared object if available.
ngingx can also build OpenSSL for you with:
--with-openssl
I seem to recall some problems with --with-openssl (but I think they were related to the FIPS Capable OpenSSL Library).
To be certain you link against the shared object, you can run the following script on the nginx sources:
OPENSSL_INSTALL_DIR=/usr/local/ssl
OPENSSL_LIB_DIR="$OPENSSL_INSTALL_DIR/lib"
...
for FILE in "auto/lib/sha1/conf" "auto/lib/md5/conf" "auto/lib/openssl/conf"
do
TFILE=`mktemp /tmp/fix.XXXXXXXXXX`
sed -e "s|-lssl|$OPENSSL_LIB_DIR/libssl.so|g" "$FILE" > "$TFILE"
mv "$TFILE" "$FILE"
TFILE=`mktemp /tmp/fix.XXXXXXXXXX`
sed -e "s|-lcrypto|$OPENSSL_LIB_DIR/libcrypto.so|g" "$FILE" > "$TFILE"
mv "$TFILE" "$FILE"
done
That will ensure the linker links against a specific OpenSSL, and not just the one it finds (I've had a lot of trouble with -L, -l, -static and -shared in the past when cross compiling).
nginx binary coming to almost 6MB.
...
and the size is coming to 1.3MB for the target.
I'm not sure how small the size can get with OpenSSL present. The following may (or may not) reduce it further.
If you compile and link with the static archive, then you also have some compiler and linker options available to you. Specifically, you can discard unused functions with gc-sections:
--with-cc-opt="-ffunction-sections -fdata-sections"
--with-ld-opt="-Wl,--gc-sections"
You also have the strip option. You can run strip -s on the final binary or pass it to the linker though options:
--with-ld-opt="-Wl,-s"
See ld(1) and --strip-debug and --strip-all options.
-Bsymbolic might also help by reducing an ELF section size (I think its either the GOT or PLT, but I don't recall at the moment).