0

I have server on Debian Jessie with OpenSSL 1.0.1t 3 May 2016.

I wanted to update OpenSSL to 1.0.2 and set custom DH parameters .

So I added backports to sources.list , and installed new OpenSSL version with

apt-get -t jessie-backports install openssl

After installation restarted Apache but on phpinfo I can see wrong OpenSSL header version:

PHP Version 7.0.17-1~dotdeb+8.1
OpenSSL Library Version OpenSSL 1.0.2k 26 Jan 2017
OpenSSL Header Version  OpenSSL 1.0.1t 3 May 2016
Openssl default config  /usr/lib/ssl/openssl.cnf 

How I can fix that?

Edit - more info for Stephen Kitt

Something is wrong and header is my only clue.

Apache:

apachectl -V

Server version: Apache/2.4.10 (Debian)
Server built:   Feb 24 2017 18:40:28
Server's Module Magic Number: 20120211:37
Server loaded:  APR 1.5.1, APR-UTIL 1.5.4
Compiled using: APR 1.5.1, APR-UTIL 1.5.4
Architecture:   64-bit
Server MPM:     prefork
  threaded:     no
    forked:     yes (variable process count)
Server compiled with....
 -D APR_HAS_SENDFILE
 -D APR_HAS_MMAP
 -D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)
 -D APR_USE_SYSVSEM_SERIALIZE
 -D APR_USE_PTHREAD_SERIALIZE
 -D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
 -D APR_HAS_OTHER_CHILD
 -D AP_HAVE_RELIABLE_PIPED_LOGS
 -D DYNAMIC_MODULE_LIMIT=256
 -D HTTPD_ROOT="/etc/apache2"
 -D SUEXEC_BIN="/usr/lib/apache2/suexec"
 -D DEFAULT_PIDLOG="/var/run/apache2.pid"
 -D DEFAULT_SCOREBOARD="logs/apache_runtime_status"
 -D DEFAULT_ERRORLOG="logs/error_log"
 -D AP_TYPES_CONFIG_FILE="mime.types"
 -D SERVER_CONFIG_FILE="apache2.conf"

OpenSSL

openssl version -a
OpenSSL 1.0.2k  26 Jan 2017
built on: reproducible build, date unspecified
platform: debian-amd64
options:  bn(64,64) rc4(16x,int) des(idx,cisc,16,int) blowfish(idx)
compiler: gcc -I. -I.. -I../include  -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -Wl,-z,relro -Wa,--noexecstack -Wall -DMD32_REG_T=int -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM
OPENSSLDIR: "/usr/lib/ssl"

After adding DH params to ssl.conf I'm getting errors

SSLOpenSSLConfCmd DHParameters /etc/ssl/private/dhparams.pem

Apache restart

service apache2 restart
Job for apache2.service failed. See 'systemctl status apache2.service' and 'journalctl -xn' for details.

systemctl status apache2.service

● apache2.service - LSB: Apache2 web server
   Loaded: loaded (/etc/init.d/apache2)
  Drop-In: /lib/systemd/system/apache2.service.d
           └─forking.conf
   Active: failed (Result: exit-code) since wto 2017-03-28 16:25:26 CEST; 11s ago
  Process: 43828 ExecStop=/etc/init.d/apache2 stop (code=exited, status=0/SUCCESS)
  Process: 51393 ExecReload=/etc/init.d/apache2 reload (code=exited, status=0/SUCCESS)
  Process: 43857 ExecStart=/etc/init.d/apache2 start (code=exited, status=1/FAILURE)

mar 28 16:25:26 domain.com apache2[43857]: Starting web server: apache2 failed!
mar 28 16:25:26 domain.com apache2[43857]: The apache2 configtest failed. ... (warning).
mar 28 16:25:26 domain.com apache2[43857]: Output of config test was:
mar 28 16:25:26 domain.com apache2[43857]: AH00526: Syntax error on line 54 of /etc/apache2/mods-enabled/ssl.conf:
mar 28 16:25:26 domain.com apache2[43857]: Invalid command 'SSLOpenSSLConfCmd', perhaps misspelled or defined by a module not included in the server configuration
mar 28 16:25:26 domain.com apache2[43857]: Action 'configtest' failed.
mar 28 16:25:26 domain.com apache2[43857]: The Apache error log may have more information.
mar 28 16:25:26 domain.com systemd[1]: apache2.service: control process exited, code=exited status=1
mar 28 16:25:26 domain.com systemd[1]: Failed to start LSB: Apache2 web server.
mar 28 16:25:26 domain.com systemd[1]: Unit apache2.service entered failed state.

1 Answer 1

2

The headers are provided by the libssl-dev package, so you can try

apt-get -t jessie-backports install libssl-dev

(Incidentally, openssl is just the openssl command-line front-end; the OpenSSL library is in the libssl1.0.0 package.)

However, I suspect the “OpenSSL Header Version” information is stored in the PHP module when it’s built, so upgrading OpenSSL won’t change it. It doesn’t matter anyway, upgrading the library is sufficient.

SSLOpenSSLConfCmd is only available with httpd 2.4.8 and later if it’s compiled with the OpenSSL headers 1.0.2 or later. That’s one instance where the features can’t be improved simply by upgrading the library; you need to upgrade the headers too and rebuild mod_ssl.

4
  • I've updated my answer. Mar 28, 2017 at 14:58
  • Although (as noted at weakdh) httpd back to 2.4.7 and 2.2.30 (per changelogs) with openssl back to 0.9.8 (which has other issues) can do custom DH using the cert file Mar 28, 2017 at 18:08
  • Yes, using other options. The OP was asking about SSLOpenSSLConfCmd. Mar 28, 2017 at 18:44
  • 1
    Thanks for all answers and comments. Rebuilding mod_ssl sounds a little too complicated for me at this moment. Finally I decided to downgrade OpenSSL to 1.0.1t, adding DH to certificate .pem file (for Apache) and ssl_dhparam to nginx conf - as I'm using VestaCP with Apache and nginx. Now everything works fine, without errors and passing ssllabs.com test with A+
    – ddadmi
    Mar 30, 2017 at 9:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.