Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an Apache 2.2 (self-compiled version) server that is getting dinged during a PCI scan because it does not support TLS 1.1 or 1.2 ciphers. After some digging I found that the installed version of OpenSSL (0.9.8e) does not contain the newest TLS ciphers. So I went and downloaded and compiled the latest version of OpenSSL (1.0.1c) and have it installed in an alternate location within /opt so it wouldn't interfere with the installed version.

What I would like to do is to compile Apache against the 1.0.1 libraries and keep the system-installed libraries for use with PHP, cURL, openssh, etc. I'm hoping that doing it this way will allow Apache to use the newest TLS but not break anything with any other programs that require the old libraries.

I thought I could do this by adding an entry in to /etc/ld.so.conf that pointed to the new libraries, but I think this will conflict with the existing ones. i.e. two references to libcrypto could cause everything to have issues.

The main reason for doing this is because of issues with PHP cURLing to external servers and having issues with the latest OpenSSL libs thus requiring edits to our PHP code.

Would love some guidance on how best to accomplish this.

share|improve this question
    
try this: LDFLAGS="-s -L/opt/ssldir/lib -Wl,-rpath=/opt/ssldir/lib" CFLAGS="-O2 -fPIC -I/opt/ssldir/include" ./configure your_apache_configure_config_here –  RJS Sep 26 '12 at 21:37
1  
If you were really using 0.9.8e (feb 2007) the cipher support is the last of you worries. Your system is insecure. Grow a pair and upgrade PHP. –  symcbean Sep 26 '12 at 21:43
1  
That's what came with RHEL 5. Time to upgrade. –  Michael Hampton Sep 27 '12 at 1:42
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.