2

I have a confusion around openssl + httpd (SSL).

I got a rhel 6 server to manage, from the previous admin. This server hosts a (HTTPS) web site.

Recently, I updated openssl to a more up-to-date version - OpenSSL 1.0.2a 19 Mar 2015

I think now I need to also re-generate the keys / cert for httpd..? Can someone please confirm or correct me here?

Edit: The issue is even though Openssl is a recent version, a vuln scan continues to say otherwise - TCP 443, openssl older version (<1.0.2) in use.. How can I check if openssl in use is 1.0.2 only and no other version.?

.....

Edit2: Adding more information after reading a new response.

At the start, the following openssl packages were installed:

# yum list openssl
Installed Packages
openssl.i686 1.0.0-27.el6
openssl.x86_64 1.0.0-27.el6

I notice that the repo configured for packages (different server) has new packages but the rhel6 box doesn't see any new updates.

So I manually copied over recent rpm openssl packages

openssl-1.0.1e-42.el6.i686.rpm
openssl-1.0.1e-42.el6.x86_64.rpm

And removed existing package:

# yum remove openssl-1.0.0-27.el6.i686
It removed this version as well as several dependencies.

Then tried installing a current version:

# yum install openssl-1.0.1e-42.el6.i686.rpm  
  Setting up Install Process Examining openssl-1.0.1e-42.el6.i686.rpm:
  openssl-1.0.1e-42.el6.i686 Marking openssl-1.0.1e-42.el6.i686.rpm as
  an update to openssl-1.0.0-27.el6.x86_64 
  Error: Nothing to do

So it didn't get installed.

Then I checked current version:

# openssl version
OpenSSL 1.0.2a 19 Mar 2015

It appears this 1.0.2a had also been installed earlier, and now it became the current version.

.....

Edit3:

Adding openssl rpm info:

$ rpm -q openssl
openssl-1.0.0-27.el6.x86_64

.....

So, rpm version and openssl version are different. Not sure if this looks right.

.....

Many thanks.

  • How did you updated OpenSSL? – Thomas Erker Sep 5 '15 at 19:49
  • Actually I didn't install openssl at all. I only removed the older version first, then when I tried to install a more recent version, it said 'nothing to do'. Apparently, the previous admin had installed 1.0.2 from src. So once I removed older version, 1.0.2 turned to be the version in use. – Sunshine Sep 5 '15 at 19:53
  • RPM usually detect dependencies (at least on newer systems) so that if you update say openSSL, the webserver is restarted automatically so that it uses the new libraries. This obviously don't work if either your openSSL or your webserver is not the one shipped with / updated by the system. – Thomas Erker Sep 5 '15 at 19:56
  • It seems that it's finding this 1.0.2 version before the distro installed version. Remember that it will continue to do this for every distro update. So when (if ever?) Red Hat update to 1.0.3, then your version will be old :-) As long as your version of Red Hat is still under support, then you are better sticking with their versions. – garethTheRed Sep 5 '15 at 19:57
  • @garethTheRed Vuln scan seems to be doing the opposite, right? It is seeing v1.0.0 and not v1.0.2. – Sunshine Sep 5 '15 at 20:01
2

It depends on why you upgraded your OpenSSL:

  • If you upgraded because it provides a cryptographic algorithm that wasn't available on your original version, then you will obviously need to use the newer OpenSSL to create new keys with this new algorithm.

  • If you upgraded because of certain well known bugs in OpenSSL and you believe your site was compromised, then you must replace your certificates. It would be wise to replace them regardless of whether you think you've been compromised - just to be on the safe side; especially if you don't know what the previous admin had done in relation to maintenance. This Red Hat article may help.

  • If you only upgraded as part of a regular maintenance process then there is no need to change certificates. OpenSSL, just like other packages, can be updated by the maintainers at regular intervals, but there is no need to replace certificates each time.

  • Thanks. I upgraded it because it was old and given the spate of openssl vulnerabilities recently. I have edited & added more info around this in my question now. – Sunshine Sep 5 '15 at 19:43
1

You usually don't have to regenerate keys and certificates when you update OpenSSL. That is only needed if there was something wrong with the key/certificate creation like the problem Debian had.

1

No. Keys and certificates are stored in a format independent of OpenSSL version (works even with other SSL/TLS implementations). The only posibility is that OpenSSL 1.0.2 might have disabled features for security reason your old keys rely on (unlikely if you key isn't stone old). But that's easy to check: start your server; if you can connect via TLS, it works.

  • Thanks for confirming. The issue is even though Openssl is a recent version, a vuln scan continues to say otherwise - TCP 443, openssl older version (<1.0.2) in use.. How can I check if openssl in use is 1.0.2 only and no other version.? – Sunshine Sep 5 '15 at 19:40
  • 1
    @Sunshine vulnerability scans based only on version numbers are flawed. CentOS/RHEL (and other distros) backport security fixes to older version of openssl. Just make sure you have the latest RPM provided by CentOS. – jordanm Sep 5 '15 at 19:46
  • @jordanm $ rpm -q openssl openssl-1.0.0-27.el6.x86_64 – Sunshine Sep 5 '15 at 19:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.