0

I have an old version of Centos (5.7) and I would like to enable TLS 1.2 due to Google Chrome warning about TLS 1.0

I tried to update with yum but I can see that no OpenSSL 1.x could be installed upon this version of Centos. So I've downloaded it manually, and installed under /usr/local/openssl

Next step: how can I "link" it to apache (I've got apache itk)?

EDIT

Just to be more precise, I need to improve my Apache web server TLS protocol from 1.0 to 1.2 and, to do that, I need to update OpenSSL and to let Apache use it (but I don't know how. Have I to recompile apache? If so, how?)

New OpenSSL version is 1.0.2a

  • "Installed it manually" -> How? As in you compiled from source? What is the exact path to the .so files? – goldilocks Apr 27 '15 at 13:56
  • @goldilocks: downloaded tar.gz, uncompress it, configured it to not override system one, make and make install. This is how I've done – DonCallisto Apr 27 '15 at 13:59
  • @goldilocks: I've written explicitly that my vesion is 1.0.2a O_O – DonCallisto Apr 27 '15 at 14:24
  • Sheesh, sorry! I'll delete that stuff. – goldilocks Apr 27 '15 at 14:27
1

So I've downloaded it manually, and installed under /usr/local/openssl

After you do a make install for a library, you need to run sudo ldconfig; this lets the linker know about it. Stuff in /usr/local should then take precedence unless you've changed the linker configuration. Double check you have a libssl with an appropriate creation time in /usr/local/lib.

To then check if apache will use it, run ldd on the binary.

> which apache
/usr/bin/apache
> ldd /usr/bin/apache | grep ssl

The path after libssl.so.10 => should be into /usr/local. Note I just made up the name of the executable there, you'll have to figure that out.


If you don't want the new libssl used by anything but apache, move it out of /usr/local/lib. Trying to avoid it ending up available there is more hassle than just moving it and prone to error and further confusion down the road. So find those libraries (they will all have identical timestamps -- I think there's actually just two, libssl and libcrypto, with symlinks) and move them to, e.g., /opt/openssl/lib. You can then start chrome with a shell script:

#!/bin/sh

export LD_LIBRARY_PATH=/opt/openssl/lib:$LD_LIBRARY_PATH
myapache $@

You'll have to move or rename the real executable (e.g., note above myapache) and then put this script into /usr/bin as apache, or whatever the name of the real executable is.

  • will sudo ldconfig change my system openssl? Because I've read that I could be in trouble. BTW I've read elsewhere I need to recompile apache. PS.: I'm doing this upon a web server, I don't need to use chrome at all, but users upon my sites will – DonCallisto Apr 27 '15 at 14:07
  • I've updated my question also – DonCallisto Apr 27 '15 at 14:10
  • You don't have a choice about running ldconfig now. If you don't do it, it will happen at some later point. I've added a bunch of stuff in above about using a specific library with chrome. As a further note, I think you are going to start running into trouble recompiling apache -- this will never end. You should just upgrade the whole system if at all possible. – goldilocks Apr 27 '15 at 14:20
  • It's not a problem of chrome. I just wanted to update OpenSSL used by Apache but I don't want to update system OpenSSL. I've read that is possible but I don't know how – DonCallisto Apr 27 '15 at 14:22
  • You can use the same strategy (starting apache with a script that exports LD_LIBRARY_PATH) as I recommended for chrome. – goldilocks Apr 27 '15 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.