Apache2 'Server' header reports wrong openSSL version

Question

Does anyone know where the Apache 'Server' header pulls the openSSL version from (file location/directory)? I am expecting openssl-1.0.1j but apache is reporting openssl-1.0.1g (system's openssl version).

I compiled apache with these options:

--enable-ssl
--with-ssl=/opt/openssl-1.0.1j

ldd mod_ssl.so

        linux-vdso.so.1 =>  (0x00007fff07357000)
        libdl.so.2 => /lib64/libdl.so.2 (0x00007f94d9895000)
        libssl.so.1.0.0 => /lib64/libssl.so.1.0.0 (0x00007f94d962b000)
        libcrypto.so.1.0.0 => /lib64/libcrypto.so.1.0.0 (0x00007f94d924f000)
        libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f94d9032000)
        libc.so.6 => /lib64/libc.so.6 (0x00007f94d8c9f000)
        /lib64/ld-linux-x86-64.so.2 (0x000000360d200000)

ls -lh /lib64/libssl.so.1.0.0

/lib64/libssl.so.1.0.0 -> /opt/openssl-1.0.1j/lib/libssl.so.1.0.0

ls -lh /lib64/libcrypto.so.1.0.0

/lib64/libcrypto.so.1.0.0 -> /opt/openssl-1.0.1j/lib/libcrypto.so.1.0.0

curl --head hostname

HTTP/1.1 200 OK
Date: Tue, 13 Jan 2015 15:27:13 GMT
Server: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1g PHP/5.6.4

Answer 1

After much digging through the Apache source, I found that that particular part of the Server response header ultimately comes from calling SSLeay_version(SSLEAY_VERSION); which reports the version of the OpenSSL libraries (as opposed to the version in the OpenSSL headers).

So if that's the case, and the mod_ssl.so shows that it should be dynamically loading the expected versions of the OpenSSL libraries, where is the old version coming from?

The only things I can think of are:

• a) the Apache you compiled is not the one that is running and responding to curl; perhaps the system/default Apache is running?
• b) the Apache that is running is loading its dynamic/shared modules from a different directory than the mod_ssl.so you examined in your post?

The most common scenario I've seen is the first: the manually compiled Apache ends up installing into e.g. /usr/local/apache2/bin/, but the system/default Apache is in a different location, and the startup scripts use that system/default location, rather than the new Apache executable you compiled/installed.