I have a confusion around openssl + httpd (SSL).
I got a rhel 6 server to manage, from the previous admin. This server hosts a (HTTPS) web site.
Recently, I updated openssl to a more up-to-date version - OpenSSL 1.0.2a 19 Mar 2015
I think now I need to also re-generate the keys / cert for httpd..? Can someone please confirm or correct me here?
Edit: The issue is even though Openssl is a recent version, a vuln scan continues to say otherwise - TCP 443, openssl older version (<1.0.2) in use.. How can I check if openssl in use is 1.0.2 only and no other version.?
Edit2: Adding more information after reading a new response.
At the start, the following openssl packages were installed:
# yum list openssl Installed Packages openssl.i686 1.0.0-27.el6 openssl.x86_64 1.0.0-27.el6
I notice that the repo configured for packages (different server) has new packages but the rhel6 box doesn't see any new updates.
So I manually copied over recent rpm openssl packages
And removed existing package:
# yum remove openssl-1.0.0-27.el6.i686 It removed this version as well as several dependencies.
Then tried installing a current version:
# yum install openssl-1.0.1e-42.el6.i686.rpm Setting up Install Process Examining openssl-1.0.1e-42.el6.i686.rpm: openssl-1.0.1e-42.el6.i686 Marking openssl-1.0.1e-42.el6.i686.rpm as an update to openssl-1.0.0-27.el6.x86_64 Error: Nothing to do
So it didn't get installed.
Then I checked current version:
# openssl version OpenSSL 1.0.2a 19 Mar 2015
It appears this 1.0.2a had also been installed earlier, and now it became the current version.
Adding openssl rpm info:
$ rpm -q openssl openssl-1.0.0-27.el6.x86_64
So, rpm version and openssl version are different. Not sure if this looks right.