On a server running RedHat 6.7 with Apache 2.4.37 I proceeded to upgrade OpenSSL to 1.1.0i following the same steps as I've done on other servers with the same set up, but on this one, somehow, 2 versions are installed:
openssl version OpenSSL 1.1.0i 14 Aug 2018 (Library: OpenSSL 1.1.0g 2 Nov 2017)
and that makes the server fail the security scan, as 1.1.0g is the one that appears on the scan and we're required to run 1.1.0i. Both versions were installed from source.
How can I either:
- Configure it to use 1.1.0i
- Remove 1.1.0g completly
- Revert the changes