I am using a centos7 build box that has openssl 1.0.1e-fips and I use configure command as follows:

  ./configure --prefix=$INSTALL_DIR \
            --enable-ssl \
            --enable-so \

it "makes" everything fine and I can see mod_ssl.so in the $INSTALL_DIR but when I deploy this in a centos7 box that has openssl 1.0.2k-fips, I expect this new version to be picked up dynamically but it does not happen?

I see this loaded modules in which I can see ssl_module as shared as well

apachectl -M
Loaded Modules:
 core_module (static)
 so_module (static)
 http_module (static)
 mpm_event_module (static)
 ssl_module (shared)
 passenger_module (shared)
 apachehmsmodule_module (shared)

and I have my httpd.conf file having this line

LoadModule ssl_module modules/mod_ssl.so

ldd modules/mod_ssl.so

ldd httpd/modules/mod_ssl.so
        linux-vdso.so.1 =>  (0x00007ffeccfa5000)
        libssl.so.10 => /lib64/libssl.so.10 (0x00007f7973ecf000)
        libcrypto.so.10 => /lib64/libcrypto.so.10 (0x00007f7973a6d000)

and it is pointing to a link

ls -lrt /lib64/libssl.so.10
lrwxrwxrwx 1 root root 16 Jan 31  2018 /lib64/libssl.so.10 -> libssl.so.1.0.2k

but if I run the query to this box using curl, it still picks up the built openssl version, why is this and how to troubleshoot to get the bottom of it?

curl --head 10.x.x.x:yyy
HTTP/1.1 400 Bad Request
Date: Wed, 08 May 2019 08:59:39 GMT
Server: Apache/2.4.37 (Unix) OpenSSL/1.0.1e-fips Phusion_Passenger/5.0.30
Content-Length: 362
Connection: close
Content-Type: text/html; charset=iso-8859-1

If I build the same with the new openssl version, then apache comes up fine.

My problem is I do not want to give new apache build for the customers to upgrade to openssl . the idea DSO is to decouple this process.

Am I missing something while "making" please suggest.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.