Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

According to these instructions:

http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI

I need to use OpenSSL 0.9.8k or later (right now it's on 1.0.0c) to use name based virtual hosts in apache. Right now I have version 0.9.8e.

I'm running CentOS with a 64 bit version of a Linux 2.6 build.

I thought an upgrade like this would be simple but apparently it's not some package that rpm can install. Where should I start?

share|improve this question

6 Answers 6

You really want to create an alternate installation of OpenSSL 1.0.0c, and not replace the system libraries. You risk breaking large parts of your CentOS system by replacing the 0.9.8k libraries. Best to just compile it and install it in /usr/local/openssl or something similar.

share|improve this answer

Don't go installing software from sources unless you really know what you are doing, and there is no other way. Not on an enterprise distribution for serious use. And much less critical stuff like OpenSSL.

Note that in Red Hat Enterprise Linux (and its derivatives, like CentOS, Scientific Linux and Oracle Linux) the software versions often look old. They are the versions Red Hat selected way back when they cut RHEL X.0, and they will only upgrade to newer versions during the decade or so RHEL X is supported if there is absolutely no other way to fix bugs. Red Hat people backport fixes and patch bugs in what they ship, the code internally probably looks much more like the latest version than the original one, but the all-important external interfaces are rigurously kept. Rest assured that even if your package version is the all time champion in CVEs, what you have installed is not vulnerable to those problems.

You need some apache functionality, have you checked it isn't available for your installation? Have you looked at EPEL? Maybe it is available in the next version (RHEL and CentOS have several currently supported versions simultaneously, check the latest)?

share|improve this answer

If you care about security do not upgrade to 1.0.1; stick with 0.9.8 1.0.1 has bugs that allow the SSL key to be determined.

share|improve this answer
    
openssl.org/news/secadv_20140407.txt "A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory to a connected client or server. Only 1.0.1 and 1.0.2-beta releases of OpenSSL are affected including 1.0.1f and 1.0.2-beta1." –  Dylan Hogg Apr 11 at 0:11
    
Could you elaborate this? Is there some documentation on which security flaws openssl 1.0.1 has not been patched against? My guess assumption was that it received the same patches as the 0.9.8. –  Thomas K Jul 14 at 11:45

This website shows you how to update the openssl on centos. http://www.pcwired.com/2013/09/how-to-set-ssl-for-pci-compliant-apache

share|improve this answer
    
Welcome to Unix & Linux Stack Exchange! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  slm Sep 7 '13 at 15:59

Try this: http://j3pd.wordpress.com/2011/08/31/upgrading-openssl/

It tells you how to check your current version, download the newest one, compile it, and install it over the old one

share|improve this answer
    
No, it does not tell you how "to install it over the old one". The blog post simply tells you how to make and install OpenSSL in /usr/local/openssl –  fpmurphy1 Aug 31 '11 at 13:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.