2

I have built Apache 2.4.25 with OpenSSL 1.0.2 successfully.

But Because of some security holes we found in our Internal tests, I have been asked to patch Openssl with the latest version. So I am trying to build Apache httpd 2.4.25 with OpenSSL 1.1.0c (or) 1.1.0d

My Environments

lsb_release -a
Distributor ID: RedHatEnterpriseServer
Description:    Red Hat Enterprise Linux Server release 5.11 (Tikanga)
Release:        5.11
Codename:       Tikanga

Perl:           5.24
PCRE:           8.38
APR:            1.5.2
APR-util:       1.5.4
OpenSSL:        1.1.0c / 1.1.0d

All the above Apache dependencies have been successfully built and installed

Apache 2.4.25 - Installation steps

cd /my/softwares
tar -xvf httpd-2.4.25.tar -C /my/build/

cd /my/build/httpd-2.4.25/

./configure --prefix=/my/apache-httpd-2.4.25 \
    --with-pcre=/my/dependencies/pcre-8.38/ \
    --with-apr=/my/dependencies/apr-1.5.2 \
    --with-apr-util=/my/dependencies/apr-util-1.5.4 \
    --enable-ssl \
    --with-ssl=/usr/local/ssl-1.1.0c \
    --enable-ssl-staticlib-deps \
    --enable-mods-static=ssl

make // see below errors
make install

I am getting the below error when building Apache from source with open ssl. Please help me in the right directions.

ssl_engine_init.c: In function 'make_dh_params':
ssl_engine_init.c:61: error: dereferencing pointer to incomplete type
ssl_engine_init.c:62: error: dereferencing pointer to incomplete type
ssl_engine_init.c:63: error: dereferencing pointer to incomplete type
ssl_engine_init.c:63: error: dereferencing pointer to incomplete type
ssl_engine_init.c: In function 'ssl_init_ctx_protocol':
ssl_engine_init.c:519: warning: 'TLSv1_client_method' is deprecated (declared at /usr/local/ssl-1.1.0c/include/openssl/ssl.h:1598)
ssl_engine_init.c:520: warning: 'TLSv1_server_method' is deprecated (declared at /usr/local/ssl-1.1.0c/include/openssl/ssl.h:1597)
ssl_engine_init.c:525: warning: 'TLSv1_1_client_method' is deprecated (declared at /usr/local/ssl-1.1.0c/include/openssl/ssl.h:1604)
ssl_engine_init.c:526: warning: 'TLSv1_1_server_method' is deprecated (declared at /usr/local/ssl-1.1.0c/include/openssl/ssl.h:1603)
ssl_engine_init.c:530: warning: 'TLSv1_2_client_method' is deprecated (declared at /usr/local/ssl-1.1.0c/include/openssl/ssl.h:1610)
ssl_engine_init.c:531: warning: 'TLSv1_2_server_method' is deprecated (declared at /usr/local/ssl-1.1.0c/include/openssl/ssl.h:1609)
ssl_engine_init.c: In function 'ssl_init_ctx_session_cache':
ssl_engine_init.c:641: warning: passing argument 2 of 'SSL_CTX_sess_set_get_cb' from incompatible pointer type
ssl_engine_init.c: In function 'use_certificate_chain':
ssl_engine_init.c:861: warning: implicit declaration of function 'BIO_s_file_internal'
ssl_engine_init.c:861: warning: passing argument 1 of 'BIO_new' makes pointer from integer without a cast
ssl_engine_init.c: In function 'ssl_init_server_certs':
ssl_engine_init.c:1201: error: dereferencing pointer to incomplete type
make[3]: *** [ssl_engine_init.lo] Error 1
make[3]: Leaving directory `/my/build/httpd-2.4.25/modules/ssl'
make[2]: *** [all-recursive] Error 1
make[2]: Leaving directory `/my/build/httpd-2.4.25/modules/ssl'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/my/build/httpd-2.4.25/modules'
make: *** [all-recursive] Error 1
3
  • " building Apache from binaries " does not sound right. How do you build binaries from binaries? You build binaries from source – Bruno9779 Feb 15 '17 at 13:57
  • @Bruno9779 - My mistake, wish I could correct the question. – user292049 Feb 15 '17 at 14:11
  • NP, I will edit it – Bruno9779 Feb 15 '17 at 14:12
1

From one of the online users comments

"As of now, with the latest version Apache HTTPD 2.4.25, the 2.4 branch is not yet compatible with Openssl 1.1.x, So have to stick with the latest 1.0.2x and stay up to date on security issues."

"There is no official statement, since OpenSSL 1.1.x became stable pratically "yesterday" there haven't been time and time to adapt 2.4 branch to it, all of this you can read about mainly in the dev and user httpd mailing list"

0

Why do you need to build Apache with statically linked ssl libraries? It is a fairly bad idea in my opinion. With dynamically linked libraries, you can just upgrade ssl when needed. With static ones you will need to recompile apache every time ssl gets patched

3
  • I wasn't aware of them - Will remove them from my configure command. – user292049 Feb 15 '17 at 14:18
  • --enable-ssl is fine, but you should be able to skip "--with-ssl=/usr/local/ssl-1.1.0c \" safely – Bruno9779 Feb 15 '17 at 14:23
  • I used the below command to re-build again.. /configure --prefix=/my/apache-httpd-2.4.25 --with-pcre=/my/dependencies/pcre-8.38/ --with-apr=/my/dependencies/apr-1.5.2 --with-apr-util=/my/dependencies/apr-util-1.5.4 --enable-ssl --with-ssl=/usr/local/ssl-1.1.0c But still getting error as mentioned in the post. – user292049 Feb 15 '17 at 14:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.