Centos – Upgrading OpenSSL in CentOS 5.3

centosopensslsnisslyum

I want to use one IP to host many domains with individual SSL certificates (requires SNI). In CentOS 5.3, the latest version of OpenSSL I can find an RPM for is 0.9.8e, which does not support SNI.

I want to upgrade to 0.9.8k but I can't find an RPM. I could compile from source, but if I try to remove the existing OpenSSL package through yum, it wants me to remove all packages that depend on OpenSSL (100+ packages).

EDIT: I ended up installing 0.9.8k without overwriting the previous version. Now I both avoid breaking dependencies and can use SNI. Was this the best action?

Best Answer

If you've simply over-written the rpm-provided files you may have... some pain later on; at the very least it's misleading for anyone who looks at the system.

In your position I'd do one of two things:

1/ Download the srpm for Centos, do an rpm -i openssl-whatever.srpm

Edit the /usr/src/redhat/SPEC/openssl.spec file to update the version and source file to the version of openssl you want to build.

Do an rpmbuild -ba /usr/src/redhat/SPEC/openssl.spec to build a newer version of the RPM. If all goes well you'll end up with some shiny new RPMs in /usr/src/redhat/RPMS/$arch and you can just drop them in.

2/ Nab the openssl srpm from a newer release (such as Fedora 12), and do an rpmbuild --rebuild openssl-whatever.srpm

Again, all going well you'll get some RPMs, although this is probably less reliable (in the sense that the ABI and dependencies may have changed from RHEL 5 to Fedora 12, for example).

Related Solutions

Centos – Install PHP 5.3 on Centos 6

To specify a version you do:

yum install php-5.3.3-14

This assumes that php-5.3.3-14 is available in the repos that your staging server. To see available php versions do:

yum list php

or yum search php and peruse the list it gives you. I am on a CentOS6 box right now and it comes with php-5.3.3-14.

I am assuming you are on Fedora since you mention php 5.4. Would it not be more advisable if you build your staging server with the same OS and repo sources as your production?

I think folks will be able to help you more if you state what OS versions and packages and what repositories are available to your production server. I might be wrong but i think that php rpms must also match the apache they are built for as a module.

Centos – Downgrade OpenSSL on CentOS 6.5

Your application needs the 0.9.8 openssl -- but does it need the 0.9.8 openssl executable, or the 0.9.8 library? (Is it trying to run openssl, or link against it?)

The CentOS openssl098e package is a "A compatibility version of a general cryptography and TLS library", and will install the libraries only - it will not install the 0.9.8 executable.

Run ldd against your application to see whether it's linking in one of the openssl libraries (libssl and libcrypto). To see what your application is trying to run, you can strace it with strace -fo /tmp/strace.out and look for the execv lines.

If your application needs the openssl executable, you'd need to recompile the 0.9.8 package for CentOS 6.

If your application needs the openssl library, then verify whether you need the x86_64 or i686 version, with ldd application. If it's looking in /lib64, then yum install yum install openssl098e.x86_64. If it's looking in /lib then yum install openssl098e.i686.

Best Answer

Related Solutions

Centos – Install PHP 5.3 on Centos 6

Centos – Downgrade OpenSSL on CentOS 6.5

Related Topic