Compiling Apache mod_ssl for different target hardware (hardware capability unsupported SSE2 error)

apache-2.2mod-sslopensslsolaris

I am building and packaging the following on one machine (the "build" machine) and attempting to install and use on other machines ("target" machines) some of which have different processors.

  • OpenSSL 0.9.8l
  • Apache 2.2.14
  • Tomcat Connectors 1.2.28

The problem, as far as I can tell, is that the build machine has more CPU capabilities than the target machine resulting in binaries that are not executable on the target machine. I have attempted to use configure and compiler flags to disable use of the offending instructions without luck.

Ultimately I get this error:

$ ./apachectl start 

httpd: Syntax error on line 58 of /usr/local/apache-2.2.14/conf/httpd.conf:
Cannot load /usr/local/apache2/modules/mod_ssl.so into server: ld.so.1: httpd: 
fatal: /usr/local/openssl/lib/libssl.so.0.9.8: hardware capability unsupported: 
0x1000 [ SSE2 ]

Here is my complete build process. Full output from each command can be viewed here. I can't link to them each directly since I don't have enough SF rep.

The Build Machine

$ echo $PATH
/usr/bin:/usr/ccs/bin:/usr/sfw/bin:/opt/sfw/bin:/usr/sbin

$ isainfo -v
32-bit i386 applications
        pause sse2 sse fxsr mmx cmov sep cx8 tsc fpu 

$ uname -a
SunOS bsiausstgdb02 5.10 Generic_120012-14 i86pc i386 i86pc

The Target Machine

$ isainfo -v
32-bit i386 applications
        sse fxsr mmx cmov sep cx8 tsc fpu 

$ uname -a
SunOS bsiausdevweb01 5.10 Generic_120012-14 i86pc i386 i86pc

Compile OpenSSL 0.9.8l

$ CC=/usr/bin/cc
$ export CC

$ CFLAGS="-xarch=sse"
$ export CFLAGS

$ ./Configure \
solaris-x86-cc \
shared \
no-asm \
no-sse2 \
-xarch=sse \
--openssldir=/usr/local/openssl-0.9.8l

view full output:
openssl-configure.txt

$ make && make test

view full output:
openssl-make-and-test.txt

$ sudo make install

view full output:
openssl-make-install.txt

Compile Apache 2.2.14

$ CC=/usr/bin/cc
$ export CC

$ CFLAGS="-xarch=sse"
$ export CFLAGS

$ ./configure \
--prefix=/usr/local/apache-2.2.14 \
--with-mpm=prefork \
--enable-so \
--enable-unique-id=shared \
--enable-rewrite=shared \
--enable-spelling=shared \
--enable-info=shared \
--enable-headers=shared \
--enable-deflate=shared \
--enable-expires=shared \
--enable-unique-id=shared \
--enable-speling=shared \
--enable-ssl=shared \
--with-ssl=/usr/local/openssl

view full output:
apache-configure.txt

$ make

view full output:
apache-make.txt

$ sudo make install

view full output:
apache-make-install.txt

Compile Tomcat Connectors 1.2.28

$ CC=/usr/bin/cc
$ export CC

$ CFLAGS="-xarch=sse"
$ export CFLAGS

$ cd native
$ ./configure \
--with-apxs=/usr/local/apache2/bin/apxs

view full output:
tomcat-connector-configure.txt

$ make

view full output:
tomcat-connector-make.txt

$ sudo make install

view full output:
tomcat-connector-make-install.txt

Testing

At this point everything will work on the build machine. Once I package these files and install them on the target machine, I get this error when Apache is started with mod_ssl enabled. 

$ ./apachectl start

httpd: Syntax error on line 58 of /usr/local/apache-2.2.14/conf/httpd.conf: 
Cannot load /usr/local/apache2/modules/mod_ssl.so into server: ld.so.1: httpd: 
fatal: /usr/local/openssl/lib/libssl.so.0.9.8: hardware capability unsupported: 
0x1000  [ SSE2 ]

Best Answer

Here are the steps that I have done to successfully build and install the Apache httpd-2.4.10 and OpenSSL openssl-1.0.1j on Solaris 10.

  1. Download following software
    openssl-1.0.1j.tar.gz
    httpd-2.4.10.tar.gz
    apr-1.5.1.tar.gz
    apr-util-1.5.4.tar.gz
    pcre-8.36.tar.gz

  2. Verify Make and CC
    By default gcc is at /usr/sfw/bin/gcc and make is at /usr/ccs/bin/make

    Include following in the PATH
    usr/local/ssl/bin:/usr/sfw/bin:/usr/local/bin:/usr/ccs/bin

    Include following in the LD_LIBRARY_PATH
    /usr/local/lib:/usr/local/ssl/lib

  3. Build and install openssl-1.0.1j
    Unzip and un-tar openssl-1.0.1j.tar.gz to /usr/local/openssl-1.0.1j
    Execute following commands in order. The shared parameter is very important so that it can be linked with httpd-2.4.10 build for SSL enabling.

    $ cd /usr/local/openssl-1.0.1j
$ ./config shared
$ make
$ make test
$ make install

    By default it installs openssl at /usr/local/ssl

  4. Install pcre-8.36 Unzip and un-tar pcre-8.36.tar.gz to /usr/local/ pcre-8.36

    Execute following commands in order 

    $ cd /usr/local/ pcre-8.36
$ ./configure 
$ make
$ make install

    By default, make install installs the package's commands under /usr/local/bin, include files under /usr/local/include, etc.

  5. Build and install httpd-2.4.10

    Unzip and un-tar httpd-2.4.10.tar.gz to /usr/local/httpd-2.4.10

    Unzip and un-tar apr-1.5.1.tar.gz to /usr/local/httpd-2.4.10/srclib
    Rename /usr/local/apr-1.5.1 to /usr/local/apr

    Unzip and un-tar apr-util-1.5.4.tar.gz to /usr/local/httpd-2.4.10/srclib
    Rename /usr/local/apr-util to /usr/local/apr-util

    Execute following commands in order

    $ ./configure --prefix=/usr/local/apache2 --with-included-apr --enable-so –enable-ssl=shared --with-ssl=/usr/local/ssl
$ make
$ make install

    It installs it at /usr/local/apache2

The installation is complete. To enable SSL and Proxy, update /usr/local/apache2/conf/httpd.conf with uncommentting following lines

LoadModule socache_shmcb_module modules/mod_socache_shmcb.so

LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_connect_module modules/mod_proxy_connect.so
LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so
LoadModule proxy_scgi_module modules/mod_proxy_scgi.so
LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so
LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
LoadModule proxy_express_module modules/mod_proxy_express.so

LoadModule slotmem_shm_module modules/mod_slotmem_shm.so
LoadModule ssl_module modules/mod_ssl.so

Include conf/extra/httpd-ssl.conf

Now you can work on httpd-ssl.conf as you usually do to complete your configuration

Related Topic