2

So I learned that to host multiple HTTPS websites on the same IP address you need an OpenSSL version that supports SNI (0.9.8f and higher). My RHEL5 box currently has 0.9.8e and Apache version httpd-2.2.26-2.el5.

According to a same question here it's not a good idea to replace the original version of OpenSSL and instead to have a parallel installation. It however doesn't explicitly mention how to achieve this.

So my questions are:

  • How do I have an alternate installation of OpenSSL without breaking the system?
  • How do I make Apache to use this version of OpenSSL and not the original one?

A detailed guide would be extremely helpful.

Improve this question
1
  • The easiest solution is to upgrade it to RHEL 6.
    – Michael Hampton
    May 28, 2014 at 13:07

2 Answers 2

Reset to default
1

The first bit is fairly easy. Download the source (0.9.8y appears to be the current version of that stream) from http://www.openssl.org, unpack, ./configure --prefix=/usr/local/openssl && make && make install.

The second bit may be harder. You might get away with starting apache with

LD_LIBRARY_PATH=/usr/local/openssl/lib/openssl /usr/sbin/httpd

(or wherever the install puts the libraries; I don't have a box with such a setup to hand in order to check it) but it may be too big a jump in versions for apache to start. If it is, you're reduced to rebuilding apache from source as well, in order to relink it against your new OpenSSL, and that will rapidly become a maintenance nightmare.

So try it, but if you can't get away with shoehorning the existing apache into run-time loading your newly-built openssl version, you'd probably be better off planning a migration to RHEL6 (or better yet, CentOS 6).

Improve this answer
2
  • RHEL subscriptions aren't tied to a specific version, so if he has RHEL 5 now, there's no license cost to upgrade the same machine to RHEL 6.
    – Michael Hampton
    May 28, 2014 at 13:12
  • An excellent point, for which many thanks. Nevertheless, I never thought there was; my preference for CentOS is based on a preference for free-as-in-speech, not free-as-in-beer.
    – MadHatter
    May 28, 2014 at 15:55
0

Maybe an alternative is to compile openssl and mod_ssl in different path and then link mod_ssl.

See: http://ssms.cs2c.com.cn/otrs/pc.pl?Action=PublicFAQZoom;ItemID=1334;ZoomBackLink=QWN0aW9uPVB1YmxpY0ZBUUV4cGxvcmVyO0NhdGVnb3J5SUQ9NDtTb3J0Qnk9RkFRSUQ7T3JkZXI9%0ARG93bjtTdGFydEhpdD0xNjE%3D%0A;

Improve this answer
1
  • Hi Juan - Welcome to ServerFault, and thanks for jumping in, here. While your answer may be useful, it is generally frowned upon to simply link to an answer on an external website due to the chances of that URL going away someday. If you're able to explain these steps, then I would recommend editing your answer and including those steps.
    – David W
    Oct 7, 2015 at 17:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .