Seems like a catch 22 here. Updating the server to a newer version is out of the question. I simply need to update Apache to a specific (older version).

The server is CentOS 6.3. The base repo is obsolete, and I have to update it to use the vault repo. But, it requires HTTPS, and any time I try to run yum after updating the repo I get:

https://vault.centos.org/centos/6/os/i386/repodata/repomd.xml: [Errno 14] problem making ssl connection

Apparently, I need to update yum, openssl, etc... But, how do I do that when I can't download the packages to begin with through yum? Is there a way to avoid manually building these packages?

Here is CentOS-Base.repo: (Note: Changing these to http doesn't seem to work)

# CentOS-Base.repo
# The mirror system uses the connecting IP address of the client and the
# update status of each mirror to pick mirrors that are updated to and
# geographically close to the client.  You should use this for CentOS updates
# unless you are manually picking other mirrors.
# If the mirrorlist= does not work for you, as a fall back you can try the
# remarked out baseurl= line instead.

name=CentOS-$releasever - Base

#released updates
name=CentOS-$releasever - Updates

#additional packages that may be useful
name=CentOS-$releasever - Extras

#additional packages that extend functionality of existing packages
name=CentOS-$releasever - Plus

#contrib - packages by Centos Users
name=CentOS-$releasever - Contrib

3 Answers 3


I managed to get yum functioning by installing all the updated packages manually.

First, I downloaded the packages from the CentOS 6.10 vault - and yes, I deliberately used 6.10 on my 6.3 server: (Note, the repo is shoddy, and I had to retry these commands multiple times)

wget --no-check-certificate https://vault.centos.org/centos/6.10/os/i386/Packages/yum-3.2.29-81.el6.centos.noarch.rpm
wget --no-check-certificate https://vault.centos.org/centos/6.10/os/i386/Packages/yum-plugin-fastestmirror-1.1.30-41.el6.noarch.rpm
wget --no-check-certificate https://vault.centos.org/centos/6.10/os/i386/Packages/yum-utils-1.1.30-41.el6.noarch.rpm
wget --no-check-certificate https://vault.centos.org/centos/6.10/os/i386/Packages/yum-metadata-parser-1.1.2-16.el6.i686.rpm
wget --no-check-certificate https://vault.centos.org/centos/6.10/os/i386/Packages/openssl-1.0.1e-57.el6.i686.rpm
wget --no-check-certificate https://vault.centos.org/centos/6.10/os/i386/Packages/openssl-devel-1.0.1e-57.el6.i686.rpm
wget --no-check-certificate https://vault.centos.org/centos/6.10/os/i386/Packages/openssl-perl-1.0.1e-57.el6.i686.rpm
wget --no-check-certificate https://vault.centos.org/centos/6.10/os/i386/Packages/openssl-static-1.0.1e-57.el6.i686.rpm
wget --no-check-certificate https://vault.centos.org/centos/6.10/os/i386/Packages/curl-7.19.7-53.el6_9.i686.rpm
wget --no-check-certificate https://vault.centos.org/centos/6.10/os/i386/Packages/libcurl-7.19.7-53.el6_9.i686.rpm
wget --no-check-certificate https://vault.centos.org/centos/6.10/os/i386/Packages/libcurl-devel-7.19.7-53.el6_9.i686.rpm
wget --no-check-certificate https://vault.centos.org/centos/6.10/os/i386/Packages/python-urlgrabber-3.9.1-11.el6.noarch.rpm
wget --no-check-certificate https://vault.centos.org/centos/6.10/os/i386/Packages/nss-3.36.0-8.el6.i686.rpm
wget --no-check-certificate https://vault.centos.org/centos/6.10/os/i386/Packages/nss-util-3.36.0-1.el6.i686.rpm
wget --no-check-certificate https://vault.centos.org/centos/6.10/os/i386/Packages/nss-tools-3.36.0-8.el6.i686.rpm
wget --no-check-certificate https://vault.centos.org/centos/6.10/os/i386/Packages/nss-sysinit-3.36.0-8.el6.i686.rpm
wget --no-check-certificate https://vault.centos.org/centos/6.10/os/i386/Packages/nss-softokn-3.14.3-23.3.el6_8.i686.rpm
wget --no-check-certificate https://vault.centos.org/centos/6.10/os/i386/Packages/nss-softokn-freebl-3.14.3-23.3.el6_8.i686.rpm
wget --no-check-certificate https://vault.centos.org/centos/6.10/os/i386/Packages/nspr-4.19.0-1.el6.i686.rpm
wget --no-check-certificate https://vault.centos.org/centos/6.10/os/i386/Packages/p11-kit-0.18.5-2.el6_5.2.i686.rpm
wget --no-check-certificate https://vault.centos.org/centos/6.10/os/i386/Packages/p11-kit-trust-0.18.5-2.el6_5.2.i686.rpm
wget --no-check-certificate https://vault.centos.org/centos/6.10/os/i386/Packages/ca-certificates-2018.2.22-65.1.el6.noarch.rpm

Then I installed the packages:

rpm -Uvh openssl*.rpm
rpm -Uvh ns*.rpm
rpm -Uvh *curl*.rpm
rpm -Uvh python-urlgrabber-3.9.1-11.el6.noarch.rpm
rpm -Uvh yum*.rpm
rpm -Uvh p11*.rpm
rpm -Uvh ca-certificates-2018.2.22-65.1.el6.noarch.rpm

If there is any warning about a package already installed, then add --force to the rpm command.

Finally, I ran yum clean all and then yum install httpd and it all worked normally again. Latest patch level of Apache installed.

Some of the packages may not be needed above. It was dependent on what was already installed on the system. For instance, if openssl-perl.i686 is not installed, don't install it, or it will need Perl dependencies installed.

  • CentOS 6 has long been unsupported (since November 2020 to be precise) and contains a ton of vulnerabilities. Just saying. If your services are facing the Internet you're looking for troubles. Feb 18, 2022 at 20:43
  • @ArtemS.Tashkinov Yes, I know. And no, they're not. Thank you. Feb 18, 2022 at 20:45
  • If you're able to run a wget against vault, then you're vulnerable unless you take a lot of care. I'd also say the repo is not shoddy. You are trying to do something that is unsupported.
    – doneal24
    Feb 18, 2022 at 21:01

I've encountered the same problem and Docker for the Webserver was the solution after so many trial and errors. I recommend not to attempt to update Apache only. There are so many dependencies that will make you despair in the end.

(I know that this should go in the comment section, but I have to few reputation to comment a question.)


End of life means they have given up trying to fix the security vulnerabilities - keeping this machine exposed creates risks for your service and for everyone else on the network. Even when that network is the internet.

Sometimes upgrading is not a viable choice - and where that is definitely the case, you should be wrapping up this server on a private network fronted by proxy running on a current platform. Coincidentally this also solves your problem of server-side SSL since only the proxy can connect, while the proxy itself can offer current protocols to the clients.

Proxying client SSL connections is a bit more complex - you need to use a SSL MITM (Squid can be configured to do this).

  • I’m full aware of the security implications and alternatives. This does not answer the question. Feb 18, 2022 at 21:07
  • Answers like these are never helpful to the problem at hand, as the comment above also points out.
    – fred
    Jan 25 at 19:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .