4

I'm compiling Apache from source, and staticly linking mod_ssl. I'm looking to use a different version of OpenSSL to the system-installed version. I would like to do this in a way that doesn't affect the rest of the system, which is CentOS, as I would prefer to not change the core system's SSL version, used by other installed software that will continue to be managed by the package manager.

How can I do this properly?

I've tried compiling Apache --with-ssl which works fine for compiling it, but then it doesn't find it when trying to run it.

./httpd: error while loading shared libraries: libssl.so.1.1: cannot open shared object file: No such file or directory

I'm thinking that perhaps I could set LD_LIBRARY_PATH when starting up Apache, which works fine, but not sure that's an appropriate approach. What's the recommended way to approach this? Is there a better way to add a directory for an alternative library search path?

Improve this question
0

2 Answers 2

Reset to default
5

First, you should get the desired version of OpenSSL and install it at a location where it will not interfere with your system version, e.g. /opt:

$ ./config \
    --prefix=/opt/openssl-VERSION \
    --openssldir=/opt/openssl-VERSION
$ make
$ sudo make install

Next, get the latest Apache 2.4.x, APR and APR-Util libraries. You will need to unpack all three packages into the same source tree, with the latter two in the location where Apache expects them. For example:

$ tar zxvf httpd-VERSION.tar.gz
$ cd httpd-VERSION/srclib/
$ tar zxvf ../../apr-VERSION.tar.gz
$ ln -s apr-VERSION/ apr
$ tar zxvf ../../apr-util-VERSION.tar.gz
$ ln -s apr-util-VERSION/ apr-util

Then, configure and install Apache. The mod_ssl module will be compiled statically, with all other modules dynamically, like this:

$ ./configure \
    --prefix=/opt/httpd \
    --with-included-apr \
    --enable-ssl \
    --with-ssl=/opt/openssl-VERSION \
    --enable-ssl-staticlib-deps \
    --enable-mods-static=ssl
$ make
$ sudo make install
Improve this answer
2
  • 1
    Awesome, thanks
    – user194553
    Jul 27, 2019 at 20:29
  • This worked for me, except I also had to build expat from source (github.com/libexpat) and provide an additional argument of --with-expat=/usr/local/lib to configure. I also included the --enable-so argument FWIW. Finally, I had to do export LD_LIBRARY_PATH=/opt/openssl-VERSION/lib:$LD_LIBRARY_PATH before i could start httpd.
    – Scott McAllister
    Dec 16, 2021 at 20:12
2

Add the LD_LIBRARY_PATH to the envvars file in the bin directory, this will then be used by apachectl.

Improve this answer

You must log in to answer this question.