1

I was running openssl0.9.8 for a long time and suddenly my SSL gave me a red X. From the company that I purchased the ssl, they told me that i need to update my server config to include tls1.2 and also to regenerate the certificate using SHA2.

Since apt-get update wasnt updating openssl, i manually compiled it and now im working with version 1.0.1j. Im able to use tls1.2 to connect to through the VPS, but even if i had included SSLProtocols -all in my apache configuration and restarted server, https://www.ssllabs.com/ssltest/ reports that my server is not using tls1.2.

I excluded sslv2 + v3 and changes were fine. Still not able to use tls1.2 although.

Any ideas? Apache version is 2.2, running debian 6, PHP5-FPM

  • Tried adding +TLSv1.2 to the config file SSLProtocols and got back: SSLProtocol: Illegal protocol 'TLSv1.2' – jeejee Apr 27 '15 at 15:46
  • You need to make sure you are loading the new module which is in a different location from your old module. What do you have for your load module statement? – Stefan Lasiewski Apr 27 '15 at 16:04
  • Don't keep using Debian 6. It's time to update your whole stack. – Michael Hampton Apr 27 '15 at 16:12
  • @StefanLasiewski I did with ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl - and it loads fine, even after reboot, but i guess that apache needs recompile in order to work with the new module. Is it true? – jeejee Apr 27 '15 at 16:30
  • /usr/bin/openssl is the commandline utility for using openssl. The Ssl module for Apache is different. Look at the LoadModule pines on your httpd.conf file. You probably do not need to recompile Apache. – Stefan Lasiewski Apr 27 '15 at 17:49
3

Debian 6 (Debian Squeeze) is an old Debian version and will not include newer utilities like OpenSSL 1.0.1 & above. Utilities like OpenSSL 0.9.8 will receive security updates until February 2016. Plan your migration to Debian stable now.

If you are not very experienced in compiling utilities like OpenSSL and replacing them in Apache, don't do it-- you are digging yourself into a rathole and you may corrupt your system.

Giles at unix.stackexchange.com says it clearly:

Debian squeeze is no longer current, so you can't expect recent versions of programs to be available for it. If you really need the openssl command line tool, you could recompile it, but do consider whether you really need that: there aren't that many new features. There are still security updates for squeeze, if that's what you're concerned about.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.