I am so new to updating server technologies it is unbelievable but we are trying to become PCI Compliant and have to update some of our server technologies. One in particular is OpenSSL.

We are currently running arch i686 0.9.8e but we have to upgrade to ATLEAST 0.9.8g.

When I run a yum update command, there are no updates available. If I run "yum info openssl" it says available packages are: arch i386 0.9.8e but the only difference is smaller file size.

I am running the following repositories:

Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * addons: mirrors.netdna.com * atomic: www6.atomicorp.com * base: mirrors.igsobe.com * extras: mirror.vcu.edu * updates: mirror.vcu.edu

any help out there?


I am running CentOS release 5.5 (Final)

When I try to manually compile using the following code:

  • cd /usr/local/src
  • rm -fR openssl-0.9.*
  • wget -N http://www.openssl.org/source/openssl-0.9.8g.tar.gz
  • gzip -d -c openssl-0.9.8n.tar.gz | gtar xvf -
  • cd openssl-0.9.8g
  • ./config
  • make
  • make install
  • alias cp=cp
  • cp -f /usr/local/ssl/bin/openssl /usr/bin/openssl
  • cd /usr/local/include
  • mv openssl openssl.old
  • ln -s /usr/local/ssl/include/openssl openssl

I get the following error:

gtar: This does not look like a tar archive gtar: Error exit delays from previous errors

  • Why do you need 0.9.8g? May 19, 2010 at 23:08
  • dont know - that's irrelevant - because the PCI Scanning Organization said so. We need 0.9.8g or more recent
    – JM4
    May 19, 2010 at 23:13
  • They probably want you to upgrade due to this brute force vulnerability: web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-0166 . If I remember, this was a pretty big deal when it came out. May 19, 2010 at 23:22
  • Can you provide more details on your CentOS version? Which version of CentOS are you running? What does "lsb_release -a" say? May 19, 2010 at 23:23
  • @Stefan - I added notes as an edit, running CentOS 5.5 final
    – JM4
    May 19, 2010 at 23:33

2 Answers 2


As a worst-case scenario, you could always just compile your own version of openssl as an RPM for your system, and then rpm -ihv.

EDIT: Starting with the source file (.tar.gz), here's what you want to do:

1) Create a new directory to house the RPM hierarchy.

# mkdir -p myopenssl/BUILD myopenssl/RPMS myopenssl/SOURCES myopenssl/SPECS myopenssl/SRPMS

2) Go into the SOURCES directory, and download your source openssl.tar.gz

# cd myopenssl/SOURCES
# mv openssl.tar.gz myopenssl/SOURCES/

3) Create a spec file that provides the necessary metadata (you will need to verify all the values are correct)

--- spec ----
%define _topdir     /home/user/myopenssl
%define name            openssl
%define release     0
%define version     x.x
%define buildroot %{_topdir}/%{name}-%{version}-root

BuildRoot:  %{buildroot}
Summary:        openssl
License:        GPL
Name:           %{name}
Version:        %{version}
Release:        %{release}
Source:         %{name}-%{version}.tar.gz
Prefix:         /usr
Group:          Development/Tools

Special build of openssl for centos.

%setup -q


make install prefix=$RPM_BUILD_ROOT/usr


%doc %attr(0444,root,root) /usr/local/share/man/man1/openssl.1

4) After you have a spec file, use the rpmbuild command to build your RPM

# rpmbuild -v -bb --clean myopenssl/SPECS/openssl.spec

5) Your RPM is built at this point... use the following command to look at the contents:

# rpm -Vp RPMS/i386/myopenssl.i386.rpm

6) To install it, run the following as root:

# rpm -ihv myopenssl.i386.rpm

Hope this helps!

  • I have absolutely no idea how to do that
    – JM4
    May 19, 2010 at 23:33
  • 1
    The nutshell version is basically you download the source, prepare/compile it into an RPM, and then install the resultant RPM. For detailed directions, ibm.com/developerworks/library/l-rpm1.
    – Tony
    May 19, 2010 at 23:36
  • this is very helpful, how do you recommend building the spec file? Is there a particular program used to do so?
    – JM4
    May 20, 2010 at 0:07
  • Use any text editor... when I first got into linux, joe was the best for me, since it was very much like edit.com from DOS. nano, vi, vim are also viable, just not as user-friendly.
    – Tony
    May 20, 2010 at 1:16

i tried this solution but i had to fix some lines:

* cd /usr/local/src
* wget -N http://www.openssl.org/source/openssl-1.0.0c.tar.gz
* tar -xzvf openssl-1.0.0c.tar.gz 
* cd openssl-1.0.0c
* ./config
* make
* make install
* alias cp=cp
* cp /usr/local/ssl/bin/openssl /usr/bin/openssl
* cd /usr/local/ssl/include
* ln -s /usr/local/ssl/include/openssl openssl

it worked for me, with centos 5.5

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .