7

According to these instructions:

http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI

I need to use OpenSSL 0.9.8k or later (right now it's on 1.0.0c) to use name based virtual hosts in apache. Right now I have version 0.9.8e.

I'm running CentOS with a 64 bit version of a Linux 2.6 build.

I thought an upgrade like this would be simple but apparently it's not some package that rpm can install. Where should I start?

0

There are a lot of people still running RHEL 5 / CentOS 5 for several reasons. But RHEL 5 is out of support and additionally there was never a package with OpenSSL >= 1 for RHEL 5.

If you don't have any concerns about using a foreign repo then you can use "tuxad repo". It provides a different and more easy way to update OpenSSL of RHEL 5 to the one of RHEL 6 (which is still supported):

  1. Install tuxad repo for RHEL 5: rpm -i http://www.tuxad.de/repo/5/tuxad.rpm
  2. Update packages: yum update

More details can be found here:

www.tuxad.de/blog/archives/2014/11/19/openssl_updatesenhancements_for_rhel__centos_5 www.tuxad.de/blog/archives/2018/07/21/tuxad_rh5_repo_now_with_phpopenssl1

This repo contains several packages which are rebuild against OpenSSL 1:

  • httpd (also include other enhancements like ECDH support)
  • postfix
  • dovecot
  • curl
  • lynx
  • mutt
  • vsftpd
  • w3m
  • wget
  • php
  • php from RHEL 6 backported (in separate repo "tuxad-php")
1

If you care about security do not upgrade to 1.0.1; stick with 0.9.8 1.0.1 has bugs that allow the SSL key to be determined.

  • openssl.org/news/secadv_20140407.txt "A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory to a connected client or server. Only 1.0.1 and 1.0.2-beta releases of OpenSSL are affected including 1.0.1f and 1.0.2-beta1." – Dylan Hogg Apr 11 '14 at 0:11
  • Could you elaborate this? Is there some documentation on which security flaws openssl 1.0.1 has not been patched against? My guess assumption was that it received the same patches as the 0.9.8. – Thomas K Jul 14 '14 at 11:45
0

This website shows you how to update the openssl on centos. http://www.pcwired.com/2013/09/how-to-set-ssl-for-pci-compliant-apache

  • Welcome to Unix & Linux Stack Exchange! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – slm Sep 7 '13 at 15:59
3

Don't go installing software from sources unless you really know what you are doing, and there is no other way. Not on an enterprise distribution for serious use. And much less critical stuff like OpenSSL.

Note that in Red Hat Enterprise Linux (and its derivatives, like CentOS, Scientific Linux and Oracle Linux) the software versions often look old. They are the versions Red Hat selected way back when they cut RHEL X.0, and they will only upgrade to newer versions during the decade or so RHEL X is supported if there is absolutely no other way to fix bugs. Red Hat people backport fixes and patch bugs in what they ship, the code internally probably looks much more like the latest version than the original one, but the all-important external interfaces are rigurously kept. Rest assured that even if your package version is the all time champion in CVEs, what you have installed is not vulnerable to those problems.

You need some apache functionality, have you checked it isn't available for your installation? Have you looked at EPEL? Maybe it is available in the next version (RHEL and CentOS have several currently supported versions simultaneously, check the latest)?

-3

Try this: http://j3pd.wordpress.com/2011/08/31/upgrading-openssl/

It tells you how to check your current version, download the newest one, compile it, and install it over the old one

  • No, it does not tell you how "to install it over the old one". The blog post simply tells you how to make and install OpenSSL in /usr/local/openssl – fpmurphy Aug 31 '11 at 13:56
5

You really want to create an alternate installation of OpenSSL 1.0.0c, and not replace the system libraries. You risk breaking large parts of your CentOS system by replacing the 0.9.8k libraries. Best to just compile it and install it in /usr/local/openssl or something similar.

2

Check out these questions at serverfault:

https://serverfault.com/questions/71298/upgrading-openssl-in-centos-5-3

https://serverfault.com/questions/128197/openssl-0-9-8k-or-higher-on-centos-5

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.