Windows – OpenSSL not enabled on apache 2.4 Windows 10

apache-2.4php7windows

I'm running php 7.1.10 on windows 10, so far if I do php -m I see openssl in extensions list, I copied libssh2.dll, ssleay32.dll, libeay32.dll to apache/bin and Windows/System32 restarted apache several times, but OpenSSL is still disabled.

Did I miss something in configuration?

Best Answer

Make sure the run time variable OPENSSL_CONF is set.

set OPENSSL_CONF=C:\Program Files\Apache Software Foundation\Apache2.4\conf\openssl.cnf

In the httpd.conf you would need some extra line (remove the # if it's there):

LoadModule ssl_module modules/mod_ssl.so

and

Include conf/extra/httpd-ssl.conf

Be sure you have created your OpenSSL certificate when you will edit the httpd-ssl.conf file.

Extra step for the certificate

openssl req -new -out server.csr
openssl rsa -in privkey.pem -out server.key
openssl x509 -in server.csr -out server.cert -req -signkey server.key -days 365

And you move the server.key and server.cert to the conf folder. (C:\Program Files\Apache Software Foundation\Apache2.4\conf)

Related Solutions

Server still vulnerable to HeartBleed after Openssl update

You likely still have a process that is using the old library.

You can test it like so:

grep 'libssl.*(deleted)' /proc/*/maps

You could alternatively bounce the entire system.

https://unix.stackexchange.com/questions/123711/how-do-i-recover-from-the-heartbleed-bug-in-openssl

CentOS Apache – Mod_Security Not Working at All

Need more information to be able to help (all the relevant apache config from httpd.conf and modsecurity.conf).

However here's some pointers which might help you solve your issue yourself:

Are you using the correct IfModule command? I use mod_security2.c but not sure if that matters:

<IfModule mod_security2.c>
    Include conf/modsecurity.conf
</IfModule>

Have you tried stopping and starting Apache completely (not a graceful restart)?

Is there anything in the error logs after a full stop and restart. It should have some [:notice] entries like this:

ModSecurity for Apache/2.9.0 (http://www.modsecurity.org/) configured.
ModSecurity: APR compiled version="1.5.0"; loaded version="1.5.0"
...etc.

That shows ModSecurity has loaded.

Are there any PCRE errors in the error log file (which can happen if ModSecurity was compiled with a different version of PRCE than Apache)? Run an ldd command against httpd and the mod_security.so to make sure they match. As an FYI I do NOT get any security modules showing when I run that "httpd -M" command on my working version - I think because it's not loaded unless an Include is run.

Is the debug log being created but empty? If it's created then that's a good sign that ModSecurity itself is being loaded.

Are your Apache settings all in /etc/httpd/conf directory like that guide you used is suggesting? Not unknown to have several version's of Apache installed and the one you're editting the config for is not the one being used :-)

I recommend Ivan Ristic's ModSecurity handbook, a taster of which is available free: https://www.feistyduck.com/library/modsecurity-handbook-free/ and this covers installation. Ivan originally wrote ModSecurity so I'd recommend buying the whole book. It's a couple of versions behind but still mostly relevant. Main change not covered by book is that a rule id is now mandatory.

Best Answer

Related Solutions

Server still vulnerable to HeartBleed after Openssl update

CentOS Apache – Mod_Security Not Working at All

Related Topic