I'm attempting to ensure that we are using the most recent openssl version on Centos 6.5, and yum reports that we are, but openssl continues to report that its version is an older one:

[vagrant@centos-65-developer ~]$ sudo yum list openssl
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
 * base: mirror.trouble-free.net
 * extras: mirrors.gigenet.com
 * rpmforge: fr2.rpmfind.net
 * updates: centos.sonn.com
Installed Packages
openssl.x86_64                      1.0.1e-16.6_5.7                   @updates

Available Packages
openssl.i686                        1.0.1e-16.el6_5.7                 updates

[vagrant@centos-65-developer ~]$ openssl version -a
OpenSSL 1.0.1e-fips 11 Feb 2013
built on: Tue Apr  8 02:39:29 UTC 2014
platform: linux-x86_64
options:  bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) idea(int) blowfish(idx)
OPENSSLDIR: "/etc/pki/tls"
engines:  dynamic

Does Centos' openssl always report incorrectly, or is this machine truly running the old version (1.0.1e-fips)?

  • You can also see that your openssl was built yesterday ("Tue Apr 8 02:39:29 UTC 2014"), so you really have the most recent package. Most probably, CentOS, similar to other distributors, just patched the 1.0.1e release instead of pushing an upgrade to 1.0.1g. – Dubu Apr 9 '14 at 17:45

I might be mistaken but what I see is the same version ?

you have openssl.x86_64 1.0.1e-16.6_5.7 installed

and your openssl reports the same version : OpenSSL 1.0.1e-fips 11 Feb 2013

  • You're not looking at the whole version. Yum reports 1.0.1e-16.6_5.7 and openssl reports 1.0.1e-fips. – bschlueter Apr 9 '14 at 15:42
  • 1
    1.0.1e is the openssl version, the rest is the RPM specific release version. If you look at the openssl site, you can see that's their version naming convention: 4459777 Feb 11 16:34:23 2013 openssl-1.0.1e.tar.gz The latest for example is : 4509047 Apr 7 19:21:29 2014 openssl-1.0.1g.tar.gz rpm.org states : name-version-release.architecture.rpm is the format so in this case -16.el6_5.7 is the release and not the actual version ( 1.0.1e ) – Moti Apr 9 '14 at 16:43
  • Okay, cool, between this and the build time, I'm confident in the update. The reason I was concerned was because the rpm release 16.6_5.7 is a patched version of openssl for the heartbleed bug, but is still the same openssl version as the prior, broken version, release 16.e16_5.4. – bschlueter Apr 9 '14 at 18:09
  • Yep, based on this : lists.centos.org/pipermail/centos-announce/2014-April/… you should be totally fine. – Moti Apr 9 '14 at 19:35

The difference is in the architecture under which the openssl package was built. The i686 and x86_64 can coexist peacefully, but make sure you at least have one that matches your machine: uname -i works to be sure.

Anyway, if you're using YUM, install the openssl.i686 one exactly by name if you want to keep the RPMdb happy. The thing is, you probably got the older i686 build installed as part of your initial install (you installed by ISO?) and got an arch you didn't need.

You could uninstall the one you don't need too, if you like, but to satisfy dependencies now, just install the one exactly by name that it wants, and move on.

  • The issue was the build version, not the architecture. I manually ran yum update openssl to get the current version, and openssl's version reporting threw me off. – bschlueter Apr 11 '14 at 19:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.