I'm trying to run an http2 web server on Amazon linux over Apache. From what I understand OpenSSL 1.0.2 is required to use Http2. However, my current distribution only supports OpenSSL 1.0.1. I've checked RedHat and its the same.

Is there an easy way to do this?

  • I presume you've a typo and your current distro only supports 1.0.1? – Barry Pollard Aug 8 '16 at 20:35
  • 1
    Last week I finished moving web servers from CentOS to Fedora, for exactly this reason. – Michael Hampton Aug 8 '16 at 21:53

Well first up you need to understand that packaged distributions offer stability and security over the latest versions. This is a trade off that works well most of the time, but leaves you behind the latest features like HTTP/2.

Crucially it does not usually leave you behind on security patches as these are usually back ported into previous versions which are easily applied by running an update (e.g. running "sudo yum update" on red hat). So I will mention security a lot in this answer rather than just simply answering your question so you can understand the concerns here.

Next up you also need to realise that HTTP/2 is still fairly new - the spec was only finalised in May 2015 and implementations for Apache (and Nginx) only started to show up at the end of 2015 and are still marked as experimental in official documentation. There have been a lot of changes and bug fixes to mod_http2 for example, though this has slowed down more recently and it now seems fairly stable. So the point is you not only want the latest version of openssl but really should install the latest version of Apache too to ensure the latest stable and secure version (notably versions 2.4.18 - 2.4.20 had a security issue in mod_http2 when using client certs for example).

So, back to the distro problem, if you want the latest features for a package (and HTTP/2 is relatively new so counts under that banner) then you've a few options:

  1. Build from source.
  2. Find another rpm or repository that packages later versions of software for your OS.
  3. Put something which does support HTTP/2 in front of your webserver.

The first two of these mean stepping outside of the officially supported packaged versions and does bring in security concerns. You'll need to stay on top of any bugs or issues in those version and do the same manual upgrades again when you think is necessary, as you lose the safety net of distro supported patches (which are much easier to apply).

Building from source is how packages used to be installed and is nowhere near as hard as some might think. I've a blog post on how to build openssl, nghttp2 and Apache httpd from source precisely to allow HTTP/2, which should work on most Linux systems (though I've not tried it on Amazon Linux), but exact config options will depend on how you run Apache. The good news is you can install openssl in a separate location just for Apache's use and continue to use the older, distro supported version for the rest of your system. However do bear in mind that a public facing webserver is obviously a key potential vulnerability and the one where you'd ideally like to be running the packaged version! Installing from source also usually requires root access and so introduces possibility of nefarious code getting on your system so you really should only download source code from official sites and mirrors. Most source code installs allow you to verify a download before you install it which is recommended. See the Apache instructions on verifying downloads for example.

Using other, unofficial packages (e.g. from http://rpmfind.net) or repositories should in theory be even simpler than building from source but shifts the security aspect to trusting those who put together the packages or manage the repos. This affects you not only in terms of trusting that they haven't altered the code, but also leaves you to trust they will continue to update and maintain newer versions in future. Honestly I'm not a big fan for those reasons and prefer to just install from source if I need a later package but maybe that's just me.

The final option is to put something in front of your webserver which does support http/2. That could be software or hardware like another webserver, load balancer or perhaps a CDN. Cloudflare for example is a CDN with excellent HTTP/2 support and even a free plan (note I have not used it but see other recommend it). Downside here is more infrastructure and you may also not wish to lose the control of managing this yourself on your server(s).

Bit long winded but hope that helps!

| improve this answer | |
  • Great response! I tried cloudflare and it was substantially slower despite all their marketing claims. – DD. Aug 10 '16 at 9:38

You can compile nginx from source and use it as a reverse proxy so it will listen on port 443 and serve apache-generated content with full http2 support...

This simple commands will do all the work for you:

yum -y groupinstall "Development Tools"
yum -y install make yum install gcc gcc-c++ kernel-devel zlib-devel pcre2-devel git
mkdir nginx
cd nginx/
git clone https://github.com/FRiCKLE/ngx_cache_purge.git
git clone https://github.com/maneulyori/nginx-http-auth-digest.git
wget https://github.com/pagespeed/ngx_pagespeed/archive/release-
unzip release-
cd ngx_pagespeed-release-
wget  https://dl.google.com/dl/page-speed/psol/
tar -xzvf psol/
cd ..
wget http://nginx.org/download/nginx-1.11.3.tar.gz
tar -xzvf nginx-1.11.3.tar.gz
wget https://www.openssl.org/source/openssl-1.0.2h.tar.gz
tar -xzvf openssl-1.0.2h.tar.gz
cd nginx-1.11.3/
./configure --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-http_ssl_module --with-http_realip_module --with-http_addition_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_stub_status_module --with-http_auth_request_module --with-mail --with-mail_ssl_module --with-file-aio --with-ipv6 --with-http_v2_module --with-cc-opt='-march=native -O2 -pipe'  --with-openssl=../openssl-1.0.2h --add-module=../ngx_pagespeed-release- --add-module=../nginx-http-auth-digest --add-module=../ngx_cache_purge
make -j 9
make install

The commands above are tested to work with CentOS 7. If your distro fails to provide you a recent GCC version, configuration might fail with an error. Please replace ./configure line (3-rd from bottom) with this one:

./configure --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-http_ssl_module --with-http_realip_module --with-http_addition_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_stub_status_module --with-http_auth_request_module --with-mail --with-mail_ssl_module --with-file-aio --with-ipv6 --with-http_v2_module --with-cc-opt='-march=native -O2 -pipe'  --with-openssl=../openssl-1.0.2h --add-module=../nginx-http-auth-digest --add-module=../ngx_cache_purge

It won't give you that nice pagespeed_module, but will perfectly build and work under CentOS6+.

| improve this answer | |
  • Not sure that would help? Nginx will also require openssl 1.0.2 (at least to deliver http/2 to Chrome users since its depreciated usaged of NPN). – Barry Pollard Aug 8 '16 at 20:41
  • Oh, now I see the problem here! Updated answer with a way to solve that... – Anubioz Aug 8 '16 at 23:15
  • 1
    Ok but if going to the hassle of installing openssl and nginx from source, then why not just stick with Apache and do the same for that? – Barry Pollard Aug 9 '16 at 1:34
  • Since recompiling apache will actually require to recompile almost everything (mod_php, mod_jk, etc), it just won't work without deep knowledge on what is going on in the system, OP hasn't even provided any information on what is he running apache for, while my nginx solution will just work no matter which modules apache uses to generate and serve content, besides using nginx in front of apache is a recommended practice, making server both faster & less memory consuming... – Anubioz Aug 9 '16 at 17:48
  • Removed link due to link going malware... – Sven Jun 26 '17 at 21:36

The new version of Amazon Linux AMI (2017.09) was released. As the part of upgrade now AMI linux uses OpenSSL 1.0.2k and HTTP/2 protocol is now supported by AMI’s httpd24 and nginx. You can upgrade your instance by running these two commands

sudo yum clean all
sudo yum update

After that you should reboot your instance and change your webserver's configs to run thru HTTP/2 protocol.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.