Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
According to these instructions:
http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI
I need to use OpenSSL 0.9.8k or later (right now it's on 1.0.0c) to use name based virtual hosts in apache. Right now I have version 0.9.8e.
I'm running CentOS with a 64 bit version of a Linux 2.6 build.
I thought an upgrade like this would be simple but apparently it's not some package that rpm can install. Where should I start?
You really want to create an alternate installation of OpenSSL 1.0.0c, and not replace the system libraries. You risk breaking large parts of your CentOS system by replacing the 0.9.8k libraries. Best to just compile it and install it in /usr/local/openssl or something similar.
Don't go installing software from sources unless you really know what you are doing, and there is no other way. Not on an enterprise distribution for serious use. And much less critical stuff like OpenSSL.
Note that in Red Hat Enterprise Linux (and its derivatives, like CentOS, Scientific Linux and Oracle Linux) the software versions often look old. They are the versions Red Hat selected way back when they cut RHEL X.0, and they will only upgrade to newer versions during the decade or so RHEL X is supported if there is absolutely no other way to fix bugs. Red Hat people backport fixes and patch bugs in what they ship, the code internally probably looks much more like the latest version than the original one, but the all-important external interfaces are rigurously kept. Rest assured that even if your package version is the all time champion in CVEs, what you have installed is not vulnerable to those problems.
You need some apache functionality, have you checked it isn't available for your installation? Have you looked at EPEL? Maybe it is available in the next version (RHEL and CentOS have several currently supported versions simultaneously, check the latest)?
Check out these questions at serverfault:
https://serverfault.com/questions/71298/upgrading-openssl-in-centos-5-3
https://serverfault.com/questions/128197/openssl-0-9-8k-or-higher-on-centos-5
If you care about security do not upgrade to 1.0.1; stick with 0.9.8 1.0.1 has bugs that allow the SSL key to be determined.
This website shows you how to update the openssl on centos. http://www.pcwired.com/2013/09/how-to-set-ssl-for-pci-compliant-apache
There are a lot of people still running RHEL 5 / CentOS 5 for several reasons. But RHEL 5 is out of support and additionally there was never a package with OpenSSL >= 1 for RHEL 5.
If you don't have any concerns about using a foreign repo then you can use "tuxad repo". It provides a different and more easy way to update OpenSSL of RHEL 5 to the one of RHEL 6 (which is still supported):
More details can be found here:
www.tuxad.de/blog/archives/2014/11/19/openssl_updatesenhancements_for_rhel__centos_5 www.tuxad.de/blog/archives/2018/07/21/tuxad_rh5_repo_now_with_phpopenssl1
This repo contains several packages which are rebuild against OpenSSL 1:
Try this: http://j3pd.wordpress.com/2011/08/31/upgrading-openssl/
It tells you how to check your current version, download the newest one, compile it, and install it over the old one
