Redhat – How to enable SNI with Apache in Redhat 5.11

apache-2.2redhatsni

I am on redhat 5.11. I want to enable SNI with apache, but I only have Apache/2.2.3 + OpenSSL 0.9.8e-fips-rhel5. I am in a very similar situation like this https://access.redhat.com/discussions/1320983

Based on this, https://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI, it seems I need to compile openssl and apache from source. Is it possible that I install the new openssl and apache from rpm packages, not compiling from source?

If I have to compile them from source, is it step-by-step guide? (I found a debian guide: https://www.howtoforge.com/enable-multiple-https-sites-on-one-ip-using-tls-extensions-on-debian-etch) and this: Installing OpenSSL that supports SNI along with previous version of OpenSSL

Best Answer

There are a lot of people still running RHEL 5 / CentOS 5 for several reasons. Unfortunately RHEL 5 is out of support and additionally there was never a package with OpenSSL >= 1 for RHEL 5.

If you don't have any concerns about using a foreign repo then you can use "tuxad repo". It provides a different and more easy way to update OpenSSL of RHEL 5 to the one of RHEL 6 (which is still supported):

  1. Install tuxad repo for RHEL 5: rpm -i http://www.tuxad.de/repo/5/tuxad.rpm
  2. Update packages: yum update

More details can be found here:

www.tuxad.de/blog/archives/2014/11/19/openssl_updatesenhancements_for_rhel__centos_5 www.tuxad.de/blog/archives/2018/07/21/tuxad_rh5_repo_now_with_phpopenssl1

This repo contains several packages which are rebuild against OpenSSL 1:

  • httpd (also include other enhancements like ECDH support)
  • postfix
  • dovecot
  • curl
  • lynx
  • mutt
  • vsftpd
  • w3m
  • wget
  • php
  • php from RHEL 6 backported (in separate repo "tuxad-php")