Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

So I learned that to host multiple HTTPS websites on the same IP address you need an OpenSSL version that supports SNI (0.9.8f and higher). My RHEL5 box currently has 0.9.8e and Apache version httpd-2.2.26-2.el5.

According to a same question here it's not a good idea to replace the original version of OpenSSL and instead to have a parallel installation. It however doesn't explicitly mention how to achieve this.

So my questions are:

  • How do I have an alternate installation of OpenSSL without breaking the system?
  • How do I make Apache to use this version of OpenSSL and not the original one?

A detailed guide would be extremely helpful.

share|improve this question
    
The easiest solution is to upgrade it to RHEL 6. –  Michael Hampton May 28 '14 at 13:07

1 Answer 1

The first bit is fairly easy. Download the source (0.9.8y appears to be the current version of that stream) from http://www.openssl.org, unpack, ./configure --prefix=/usr/local/openssl && make && make install.

The second bit may be harder. You might get away with starting apache with

LD_LIBRARY_PATH=/usr/local/openssl/lib/openssl /usr/sbin/httpd

(or wherever the install puts the libraries; I don't have a box with such a setup to hand in order to check it) but it may be too big a jump in versions for apache to start. If it is, you're reduced to rebuilding apache from source as well, in order to relink it against your new OpenSSL, and that will rapidly become a maintenance nightmare.

So try it, but if you can't get away with shoehorning the existing apache into run-time loading your newly-built openssl version, you'd probably be better off planning a migration to RHEL6 (or better yet, CentOS 6).

share|improve this answer
    
RHEL subscriptions aren't tied to a specific version, so if he has RHEL 5 now, there's no license cost to upgrade the same machine to RHEL 6. –  Michael Hampton May 28 '14 at 13:12
    
An excellent point, for which many thanks. Nevertheless, I never thought there was; my preference for CentOS is based on a preference for free-as-in-speech, not free-as-in-beer. –  MadHatter May 28 '14 at 15:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.