0

I am running Apache 2.2.18 on my work machine and have a dedicated IP and paid SSL certificate. Since this server should be secure, I only use HTTPS when I access it. To do a test I went to ssllabs.com so see what the result for my web server would be. The results I got were pretty terrible. One reason I found is because it was using, by default, OpenSSL 0.9.8r and SSLv2 for browser support. I followed the guide to secure my server and use TLS instead to harden it up, but my build of apache only support TLSv1 and not TLSv1.1 and TLSv1.2.

I then installed the newest OpenSSL from the ssllounge as you can see below, and placed those files in my Apache\Bin folder.

 OpenSSL> version
 OpenSSL 1.1.0b  26 Sep 2016

My server still shows the following tho:

 Apache / 2.2.18 (Win32) mod_ssl / 2.2.18 OpenSSL / 0.9.8r

I am aware that because of how things are set up I need a new version of the mod_ssl.so for my apache. I have Visual C++ 2008, Windows SDK 6.1, and downloaded the newest source for mod_ssl from their website.

What do I do now? I haven't compiled anything with C++ before and I am unsure of what I need to do to upgrade my mod_ssl so it uses the new openSSL 1.1.0 that I downloaded and installed. Thanks and sorry for being a noob..

1 Answer 1

1

Download binaries from http://www.apachelounge.com/download/ & replace your current apache by overwriting. Make sure to convert your configuration files first.

5
  • So upgrade to apache 2.4 then since those binarys wont run on apache 2.2...
    – Kaboom
    Oct 6, 2016 at 16:58
  • Yes, pretty much like that. Make sure you upgrade your configuration files by replacing Order allow,deny Allow from all with Require all granted & Order deny,allow Deny from all with Require all denied everything will work just fine
    – Anubioz
    Oct 6, 2016 at 17:03
  • i downloaded the newest 2.4, put it in my apache folder, run the exe. and it still shows apache 2.2 but its loading from the newer exe..? what the hell lol
    – Kaboom
    Oct 6, 2016 at 17:06
  • Make sure you have replaced that actual httpd.exe that runs as a service. Use sc qc apache to determine which one is running
    – Anubioz
    Oct 6, 2016 at 17:08
  • BTW running apache on windows is an offtopic here, just get a linux box/vm. Or go to SuperUser with your question :)
    – Anubioz
    Oct 6, 2016 at 17:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .