After a global upgrade (apt-get upgrade) Apache2 won't work with SSL anymore.
Ubuntu 16
Apache version : 2.4.37
OpenSSL version : OpenSSL 1.1.1-pre7 (beta) 29 May 2018
LD_LIBRARY_PATH=/usr/local/lib
When I try to start the service I get the following error:
Dec 12 18:43:59 labo apachectl[1677]: apache2: Syntax error on line
146 of /etc/apache2/apache2.conf: Syntax error on line 2 of
/etc/apache2/mods-enabled/ssl.load: Cannot load
/usr/lib/apache2/modules/mod_ssl.so into server:
/usr/lib/apache2/modules/mod_ssl.so: symbol
SSL_CTX_set_post_handshake_auth, version OPENSSL_1_1_1 not defined in
file libssl.so.1.1 with link time reference
If I disable ssl from apache2 I can successfully start the service.
I tried to reinstall apache2 & openssl, it doesn't get any better.
Solved
Found the problem:
The OpenSSL version I was using was the wrong one. I compiled OpenSSL1.1.1-pre7 several months ago to fit some security requirements. Apparently the upgrade didn't update OpenSSL to the good version (OpenSSL 1.1.1 11 Sep 2018).
the following steps made the correction:
~# sudo a2dismod ssl
~# sudo apt-get purge openssl
~/openssl-1.1.1-pre7# make uninstall //Uninstall the version I build
~# sudo apt-get install openssl
~# sudo a2enmod ssl
Related
I have Ubuntu 16.04. It has OpenSSL 1.0.2g. I need to use OpenSSL 1.1.0g. Note that OpenSSL 1.1.0g is installed in my other machine Ubuntu 18. But I need to run a python program in Ubuntu 16.04 but I need the specific OpenSSL 1.1.0g. I did:
sudo apt-get upgrade
sudo apt-get update
But OpenSSL in my Ubuntu machine did not get updated. How can I update it?
I use python socket, ssl modules to make TLS connection in port 443. Will python automatically recognizes OpenSSL 1.1.0g if I updated the old OpenSSL 1.0.2g to OpenSSL 1.1.0g?
The reason for upgrading OpenSSL is I need to run python program ssl socket but I need the program to use OpenSSL 1.1.0g.
When I tried:
sudo apt-get install openssl
and checks the OpenSSL version via: openssl version -a
I get the old version OpenSSL 1.0.2g
How to get the new version OpenSSL 1.1.0g in my Ubuntu 14.06 machine please?
Why you couldn't get OpenSSL 1.1.0g working on Ubuntu 16.04 by just updating:
Your Ubuntu 18 has OpenSSL 1.1.0g because the version that is available on its repositories. Sometimes, it has more than one version of a package available on the repository system. But, it looks like Ubuntu 16.04 does not have the version you need available at all. That is why you weren't and you won't be able to get OpenSSL 1.1.0g working on Ubuntu 16.04 by just updating. The version available on the repositories is different.
And how to do it:
You either will need to install it manually or find a repository for Ubuntu 16.04 that make OpenSSL 1.1.0g available on the system. I am not sure there is a repository available, so if you want to install it manually do as it follows:
wget https://www.openssl.org/source/old/1.1.0/openssl-1.1.0g.tar.gz
tar xzvf openssl-1.1.0g.tar.gz
cd openssl-1.1.0g
./config
make
sudo make install
openssl version -a
That is it!
Warning.: By installing a new version of OpenSSL that is not available in the system, by default, you introduced a version that is not compatible with the updates made available by the maintenance of the system. You will need to take care of it yourself. Maybe, depending on your scenario, it is worth your while just use Ubuntu 18 that has the version of OpenSSL you need by default. It is the easiest and safest way to go.
Hope everything goes well.
Good luck!
Here is how I installed the latest version of openssl from source code.
# Install make and packages required to compile the source code
apt-get install -y libfindbin-libs-perl build-essential
# Download source code
wget https://github.com/openssl/openssl/archive/refs/tags/OpenSSL_1_1_1k.tar.gz -O openssl.tar.gz
# Extract source code
tar -xf openssl.tar.gz
# Go to the source code folder
cd openssl-OpenSSL_1_1_1k
# Configure to compile it
./config --libdir=/usr/local/lib
# Compile with 4 parelel jobs
make -j 4
# Install compiled code
sudo make install
# Move older executable
sudo mv /usr/bin/openssl /usr/bin/openssl-1.0.2g
# Create soft symbolic link to the newer version of openssl
sudo ln -s /usr/local/bin/openssl /usr/bin/openssl
# Make visible the new libraries installed at /usr/local/lib
sudo ldconfig
I need Apache2.4 with ssl.
AWS RHEL server I am using already has Apache2.2 and openssl 0.9 installed. I configured my Apache,apr,apr-util and pcre packages at /opt/products/apache2. everything is fine except the option
--enable-ssl
fails due to a dependency failure (openssl > 0.9.8a). No problem. I downloaded openssl 1.0.2a from open ssl and configured and installed it at /opt/openssl without problem.
Now I need to configure Apache with
--enable-ssl --with-ssl=/opt/openssl
but the configure command returns the error
"invalid variable name 'with-ssl'".
configure -help shows that with-ssl is an option.
Is this a bug or something? I don't find any reference on the internet.
Just wanted to update for anyone looking at this later.
Installing all the pre-requisites before configuring apache solves the problem of apache giving version error. So this command before the apache configuration solved the problem:
yum install gcc libxml2-devel gcc-c++ libicu-devel libxslt-devel bzip2 bzip2-devel libjpeg-devel libpng libpng-devel freetype freetype-devel curl curl-devel t1lib-devel unixODBC-devel openssl-devel openssl
and I did not have to install openssl separately.
hello i trying to install libapache2-mod-fcgid mod but have always get error.
root#mail:~# sudo apt-get install libapache2-mod-fcgid
Reading package lists... Done
Building dependency tree
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:
The following packages have unmet dependencies:
libapache2-mod-fcgid : Depends: apache2.2-common but it is not going to be installed
E: Unable to correct problems, you have held broken packages.
and without fcgid mod i cannot launch apache server
root#mail:~# service apache2 restart
* Restarting web server apache2 [fail]
* The apache2 configtest failed.
Output of config test was:
apache2: Syntax error on line 140 of /etc/apache2/apache2.conf: Syntax error on line 1 of /etc/apache2/mods-enabled/fcgid.load: Cannot load /usr/lib/apache2/modules/mod_fcgid.so into server: /usr/lib/apache2/modules/mod_fcgid.so: cannot open shared object file: No such file or directory
Action 'configtest' failed.
The Apache error log may have more information.
apache version 2.4
This worked for me: Ubuntu 21.10 in year 2022:
sudo apt-get install -y libapache2-mod-fcgid
I know it is a bit late for a response but, since there is no answer yet, I'll put one.
In this situation, the dependencies from libapache2-mod-fcgid are not met. In this case, you could download and install apache2.2-common prior the installation of libapache2-mod-fcgid like this:
sudo apt-get install apache2.2-common
and then try your install command afterward.
we are using apache webserver ver 2.2.3 with open SSL version 0.9.8e-fips-rhel5 (linux environment). We are required to upgrade the openSSL to the latest version for security reasons. I have following doubts
as per https://www.openssl.org/news/secadv_20140605.txt, ver 0.9.8 should be upgraded to 0.9.8za. Please let me know if its ok to upgrade to 0.9.8za or we should go for 1.0.1h
what is the procedure of upgrading openssl which comes with apache webserver
Is it required to regenerate the keys and certificate again
You can update with below command
yum update openssl
I install ssh2 on my server
but when i check the result is :
PHP Warning: PHP Startup: ssh2: Unable to initialize module
Module compiled with module API=20100525
PHP compiled with module API=20090626
These options need to match in Unknown on line 0
I uses centos 6 and directadmin
libssh2 is notoriously difficult to install. Personally, I would recommend you try phpseclib, a pure PHP SSH2 implementation.
You could try to install ssh2 through yum, enabling remi.repo if required:
$ sudo yum install php-pecl-ssh2
It will install php-pecl-ssh2 package of the same version as your PHP is.
But it also possible to install it through pecl if you have any reasons to do it:
# yum install php-devel
# pecl channel-update pecl.php.net
# pecl install ssh2
Tested for Oracle Linux 7.