Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

EDIT When I check the version in Putty "openssl version" it says Im using the new version but php is still showing the old?

I did the following with Putty and it looked like it worked but I am still seeing the old version when I view my phpinfo() file.

I am failing the PCI test and really need to get this fixed.

Do I need to delete the old version first? Is that safe?

Apache/2.2.20 (Unix) mod_ssl/2.2.20 OpenSSL/0.9.8e-fips-rhel5 
mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.3.8 

putty commands

* cd /usr/local/src
* wget -N http://www.openssl.org/source/openssl-1.0.0c.tar.gz
* tar -xzvf openssl-1.0.0c.tar.gz 
* cd openssl-1.0.0c
* ./config
* make
* make install
* alias cp=cp
* cp /usr/local/ssl/bin/openssl /usr/bin/openssl
* cd /usr/local/ssl/include
* ln -s /usr/local/ssl/include/openssl openssl
share|improve this question
    
Did you restart apache? –  EEAA Sep 22 '11 at 1:40
    
@ErikA I did using cpanel whm, Still shows the same old version –  Michael Howey Sep 22 '11 at 1:42
    
Out of curiosity, what Linux distribution are you running on? –  Rilindo Sep 22 '11 at 1:42
    
@Rilindo WHM 11.30.3 (build 5) CENTOS 5.6 i686 standard on ip-208-109-104-23 –  Michael Howey Sep 22 '11 at 1:43
1  
No, my point is that there is no need for you to build a version of openssl to begin with. As long as RedHat/CentOS back ports the updates, you just upgrade with their updated packages and you are done. If you are failing PCI Compliance because of a version number, then the problem is with the process, not with the package. –  Rilindo Sep 22 '11 at 1:51

2 Answers 2

Unfortunately the PCI compliance test is... naive, and only checks the version number. You need to find out which specific vulnerabilities it's looking for and then check the OpenSSL package changelog (rpm --changelog openssl) to verify that yes, those vulnerabilities have been patched.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.