We are concerned with the OpenSSL vulnerabilities and are running a SLES11SP1 server. unfortunately, due to admin reasons, our support expired, and so we are looking at manually upgdating OpenSSL and its required libraries manually. Is there a script, or recommended way to get the latest version of OpenSSL and make either an RPM or install the modules directly on the OS ?
It is not possible without updating most of the system. I tried the same with a CentOS 5.x and ended up wasting a lot of time.
What you could do (tried this, too, but ended up upgrading the whole system instead) is to install the sources of OpenSSL and your web server etc. -- whatever you wish to run with your new SSL, then compile these with a different compile root, e.g. in
A remaining problem will be that no easy upgrade route is available when a newer version of OpenSSL is released.
One workaround (wildly brainstorming now) could be to run a virtual machine with a newer system, running your SSL-based services, if there is no way of upgrading the (guest) OS.
Another workaroud would be to compile these services (like apache) against a static build of openSSL (which you would need to compile) - again lots of work.