Does anyone know where the Apache 'Server' header pulls the openSSL version from (file location/directory)? I am expecting openssl-1.0.1j but apache is reporting openssl-1.0.1g (system's openssl version).

I compiled apache with these options:


ldd mod_ssl.so

        linux-vdso.so.1 =>  (0x00007fff07357000)
        libdl.so.2 => /lib64/libdl.so.2 (0x00007f94d9895000)
        libssl.so.1.0.0 => /lib64/libssl.so.1.0.0 (0x00007f94d962b000)
        libcrypto.so.1.0.0 => /lib64/libcrypto.so.1.0.0 (0x00007f94d924f000)
        libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f94d9032000)
        libc.so.6 => /lib64/libc.so.6 (0x00007f94d8c9f000)
        /lib64/ld-linux-x86-64.so.2 (0x000000360d200000)

ls -lh /lib64/libssl.so.1.0.0

/lib64/libssl.so.1.0.0 -> /opt/openssl-1.0.1j/lib/libssl.so.1.0.0

ls -lh /lib64/libcrypto.so.1.0.0

/lib64/libcrypto.so.1.0.0 -> /opt/openssl-1.0.1j/lib/libcrypto.so.1.0.0

curl --head hostname

HTTP/1.1 200 OK
Date: Tue, 13 Jan 2015 15:27:13 GMT
Server: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1g PHP/5.6.4

After much digging through the Apache source, I found that that particular part of the Server response header ultimately comes from calling SSLeay_version(SSLEAY_VERSION); which reports the version of the OpenSSL libraries (as opposed to the version in the OpenSSL headers).

So if that's the case, and the mod_ssl.so shows that it should be dynamically loading the expected versions of the OpenSSL libraries, where is the old version coming from?

The only things I can think of are:

  • a) the Apache you compiled is not the one that is running and responding to curl; perhaps the system/default Apache is running?
  • b) the Apache that is running is loading its dynamic/shared modules from a different directory than the mod_ssl.so you examined in your post?

The most common scenario I've seen is the first: the manually compiled Apache ends up installing into e.g. /usr/local/apache2/bin/, but the system/default Apache is in a different location, and the startup scripts use that system/default location, rather than the new Apache executable you compiled/installed.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.