Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I need to upgrade OpenSSL on my CentOS server to 0.9.8k or higher, however the latest version in the official CentOS repositories is 0.9.8e, much too old. Is there a 3rd party repository I can use that has newer versions of OpenSSL libraries? If not, can someone provide a quick walkthrough of compiling a newer version of OpenSSL for CentOS? I need it to replace the built in version, so the walkthrough would have to explain how to create a CentOS-compatible RPM.

share|improve this question
2  
Why do you want to get that 0.9.8k or higher? Do you need any new feature or do you need a CVE bugfix? The latter is usually backported to 0.9.8e by RedHat. See Rilindos answer below. –  Nils Nov 9 '11 at 20:34
    
Myself, I am looking for specific OpenSSL features, such as Server Name Indication. Apparently there are no OpenSSL 1.x RPMs available for EL5, so I'd simply need to compile or roll my own RPMs to install to /opt or elsewhere , and tell specific applications to use those specific OpenSSL libraries. –  Stefan Lasiewski Nov 14 '11 at 18:37

3 Answers 3

up vote 10 down vote accepted

Let me guess - PCI?

What you really want is to look at Red Hat's CVE archives (which CentOS is based on) and verified whether the vulnerability has been fixed based on that list (most of the time, it has been). If you are using a third-party scanner that doesn't recognize your current version, look up the OVAL definitions to see the status of the vulnerabilities as well as whether the fixes were back ported; from there, you can map them to the current "generic" versions of your applications / libraries (in this case, OpenSSL).

Red Hat's link gives more details (which CentOS reference) as their backports policy. You may want to review it and save yourself the trouble of rebuilding OpenSSL.

share|improve this answer

Be aware that RedHat backports security fixes and such to packages and only increments the package subversion number and not the versioning of the package. Since Centos comes directly from RedHat, I might expect the same from their packaging as well.

share|improve this answer

Upgrade to Centos 6. It has version 1.0.0 built-in. See the list of packages and RPMs here: http://mirror.centos.org/centos/6/os/i386/Packages/

But it is never a good idea to install two versions of the same software on one system.

share|improve this answer
2  
Important to note that there is no supported "upgrade" from 5.x to 6.x. RedHat says "Red Hat does not support in-place upgrades between any major versions of Red Hat Enterprise Linux". –  Stefan Lasiewski Nov 14 '11 at 18:33
    
@StefanLasiewski How bad is that! Says a proud user of Debian (and derivates) where these impediments don't exist. –  mailq Nov 14 '11 at 23:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.