Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am running Centos 6.5 2.6.32-431.11.2.el6.x86_64.

I have Apache PHP and openssl which I compiled from source

apache2.4.7 php 5.5.10 openssl 1.0.1f

I have updated apache to 2.4.7 on another instance sucessfully, but on this server I get the following error.

httpd: Syntax error on line 129 of /usr/local/apache2/conf/httpd.conf: Cannot load   modules/mod_ssl.so into server: /usr/local/apache2/modules/mod_ssl.so: undefined symbol: SSL_get_srp_userinfo

my config for the openssl is

./config --prefix=/usr/local --openssldir=/usr/local/openssl -fPIC

my config for apache, which is the config.nice for the previous 2.4.7 install is

"./configure" \
"--enable-so" \
"--with-included-apr" \
"--enable-ssl" \
"--with-ssl=/usr/local/openssl" \

I can see from the config.status that it is looking in the right place for the ssl

S["MOD_SSL_LDADD"]="-export-symbols-regex ssl_module"
S["ab_LDFLAGS"]="-L/usr/local/openssl/lib -lssl -lcrypto -lrt -lcrypt -lpthread"
S["ab_CFLAGS"]="-I/usr/local/openssl/include"

however when doing an ldd on the actual mod_ssl.so shows something totally different then what I see on all the other apache installation that I have working with mod_ssl.

normally on all the working installation I see something like

# ldd /usr/local/apache2/modules/mod_ssl.so
    linux-vdso.so.1 =>  (0x00007fff489ff000)
    librt.so.1 => /lib64/librt.so.1 (0x00007f839028d000)
    libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00007f8390056000)
    libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f838fe38000)
    libc.so.6 => /lib64/libc.so.6 (0x00007f838faa5000)
    /lib64/ld-linux-x86-64.so.2 (0x00007f83908bd000)
    libfreebl3.so => /lib64/libfreebl3.so (0x00007f838f843000)
    libdl.so.2 => /lib64/libdl.so.2 (0x00007f838f63e000)[/CODE]

however, on this particular installation, i see

# ldd /usr/local/apache2/modules/mod_ssl.so
    linux-vdso.so.1 =>  (0x00007ffff1bff000)
    libssl.so.10 => /usr/lib64/libssl.so.10 (0x00007f93f743b000)
    librt.so.1 => /lib64/librt.so.1 (0x00007f93f7232000)
    libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00007f93f6ffb000)
    libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f93f6dde000)
    libc.so.6 => /lib64/libc.so.6 (0x00007f93f6a49000)
    libgssapi_krb5.so.2 => /lib64/libgssapi_krb5.so.2 (0x00007f93f6805000)
    libkrb5.so.3 => /lib64/libkrb5.so.3 (0x00007f93f651f000)
    libcom_err.so.2 => /lib64/libcom_err.so.2 (0x00007f93f631a000)
    libk5crypto.so.3 => /lib64/libk5crypto.so.3 (0x00007f93f60ee000)
    libcrypto.so.10 => /usr/lib64/libcrypto.so.10 (0x00007f93f5d0e000)
    libdl.so.2 => /lib64/libdl.so.2 (0x00007f93f5b09000)
    libz.so.1 => /lib64/libz.so.1 (0x00007f93f58f3000)
    /lib64/ld-linux-x86-64.so.2 (0x00007f93f7a7b000)
    libfreebl3.so => /lib64/libfreebl3.so (0x00007f93f567c000)
    libkrb5support.so.0 => /lib64/libkrb5support.so.0 (0x00007f93f5470000)
    libkeyutils.so.1 => /lib64/libkeyutils.so.1 (0x00007f93f526d000)
    libresolv.so.2 => /lib64/libresolv.so.2 (0x00007f93f5053000)
    libselinux.so.1 => /lib64/libselinux.so.1 (0x00007f93f4e33000)[/CODE]

this is a lot more extensive. I Do not think this could be because apache is not reading from the correct location for openssl.

Any suggestions are welcome.

thanks,

share|improve this question
1  
Why are you building all these packages from source? –  Michael Hampton Apr 7 at 18:12
    
In order to PCI compliant, need to have the latest security patches. –  user207044 Apr 7 at 22:24
    
That doesn't necessarily mean you have to build everything from source. All of these packages are available in reliable repositories with full security updates. –  Michael Hampton Apr 7 at 22:40
    
And of course you have to upgrade OpenSSL again... –  Michael Hampton Apr 11 at 16:36

2 Answers 2

Ok,

The solution was to put the actual LDFLAGS configuration in the actual configuration. so it should look like this

LDFLAGS="-L/usr/local/lib64"; export LDFLAGS
"./configure" \
"--enable-so" \
"--with-included-apr" \
"--enable-ssl" \
"--with-ssl=/usr/local/openssl" \
"LDFLAGS=-L/usr/local/lib64" \
"$@"
share|improve this answer

I am running CentOS 6.5 2.6.32-431.17.1.el6.x86_64, mostly for supporting Java servlet containers

Thanks to your auto-answer, I've been able to build and get httpd running with SSL. The breakthrough for me was building both openssl and httpd with PIC/pie as appropriate

config arguments for OpenSSL 1.0.1h 5 Jun 2014 were used in this context

cd openssl-1.0.1h
./config -fPIC --prefix=/usr/local --openssldir=/usr/local/openssl
    make
    make test
    sudo make install

config for Apache/2.4.9 (Unix) APR 1.5.1, APR-UTIL 1.5.3 was this context

export LDFLAGS=”-L/usr/local/lib64”
./configure  --prefix=/usr/local/httpd \
   --enable-so \
   --enable-pie \
   --with-apr=/usr/local/apr/bin/apr-1-config \
   --enable-ssl \
   --with-ssl=/usr/local/openssl \
   --enable-allowmethods \
   --enable-info \
   --enable-speling \
   --with-mpm=prefork \
   LDFLAGS=-L/usr/local/lib64 \
   $@

And the changes that I made to httpd.conf before it worked were:

User apache
Group apache

LoadModule ssl_module modules/mod_ssl.so
LoadModule socache_shmcb_module modules/mod_socache_shmcb.so

Include conf/extra/httpd-ssl.conf

After which all that was necessary was to generate a self-signed cert and point to them appropriately in

conf/extra/httpd-ssl.conf

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.