3

I am trying to upgrade the openssl libraries on an OpenSuse 11.4 server so that they can match the new Paypal security standards (https://www.paypal-knowledge.com/infocenter/index?page=content&widgetview=true&id=FAQ1914&viewlocale=en_US).

Previously I had this openssl version installed:

openssl version
OpenSSL 1.0.0c 2 Dec 2010

I checked for an update:

zypper update openssl
Loading repository data...
Warning: Repository 'Updates for openSUSE 11.4 11.4-0' appears to outdated. Consider using a different mirror or server.
Reading installed packages...
No update candidate for 'openssl-1.0.0c-18.42.1.x86_64'. The highest available version is already installed.
Resolving package dependencies...

Since zypper wasn't able to find the new openssl version I have added the Evergreen repo:

sudo zypper ar --refresh -r http://download.opensuse.org/evergreen/11.4/openSUSE:Evergreen:11.4.repo
Adding repository 'Evergreen update repository for openSUSE 11.4 (standard)' [done]
Repository 'Evergreen update repository for openSUSE 11.4 (standard)' successfully added
Enabled: Yes
Autorefresh: Yes
URI: http://download.opensuse.org/repositories/openSUSE:/Evergreen:/11.4/standard/

Then I did a refresh of the repositiories:

zypper refresh
Repository 'Updates for openSUSE 11.4 11.4-0' is up to date.
Retrieving repository 'Evergreen update repository for openSUSE 11.4 (standard)' metadata [\]

New repository or package signing key received:
Key ID: 241B84B36A0F1588
Key Name: openSUSE:Evergreen OBS Project <openSUSE:Evergreen@build.opensuse.org>
Key Fingerprint: D25EAF514D59C654B9BCE005241B84B36A0F1588
Key Created: Fri 15 May 2015 03:33:05 PM CEST
Key Expires: Sun 23 Jul 2017 03:33:05 PM CEST
Repository: Evergreen update repository for openSUSE 11.4 (standard)

Do you want to reject the key, trust temporarily, or trust always? [r/t/a/?] (r): a
Retrieving repository 'Evergreen update repository for openSUSE 11.4 (standard)' metadata [done]
Building repository 'Evergreen update repository for openSUSE 11.4 (standard)' cache [done]
Repository 'openSUSE-11.4-Non-Oss' is up to date.
Repository 'openSUSE-11.4-Oss' is up to date.
All repositories have been refreshed.

and finally the openssl update:

zypper update openssl
Loading repository data...
Warning: Repository 'Updates for openSUSE 11.4 11.4-0' appears to outdated. Consider using a different mirror or server.
Warning: Repository 'Evergreen update repository for openSUSE 11.4 (standard)' appears to outdated. Consider using a different mirror or server.
Reading installed packages...
Resolving package dependencies...

The following package is going to be upgraded:
  openssl 

1 package to upgrade.
Overall download size: 541.0 KiB. After the operation, additional 77.0 KiB will be used.
Continue? [y/n/?] (y): y
Retrieving package openssl-1.0.1p-74.1.x86_64 (1/1), 541.0 KiB (1.3 MiB unpacked)
Retrieving: openssl-1.0.1p-74.1.x86_64.rpm [done (844.4 KiB/s)]
Installing: openssl-1.0.1p-74.1 [done]

I restarted apache:

/etc/init.d/apache2 restart
Syntax OK
Shutting down httpd2 (waiting for all children to terminate)                                                              done
Starting httpd2 (prefork)

And checked the compliance with Paypal:

php -r '$ch = curl_init(); curl_setopt($ch, CURLOPT_URL, "https://tlstest.paypal.com/"); var_dump(curl_exec($ch)); var_dump(curl_error($ch));'
bool(false)
string(67) "Unknown SSL protocol error in connection to tlstest.paypal.com:443 "

The openssl version now is showing me "(Library: OpenSSL 1.0.0c 2 Dec 2010)":

openssl version -a
OpenSSL 1.0.1p 9 Jul 2015 (Library: OpenSSL 1.0.0c 2 Dec 2010)
built on: 2012-05-23 05:01:20.000000000 +0000
platform: linux-x86_64
options:  bn(64,64) rc4(1x,char) des(idx,cisc,16,int) blowfish(idx) 
compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -DTERMIO -O3 -Wall -DMD32_REG_T=int -fmessage-length=0 -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector -funwind-tables -fasynchronous-unwind-tables -g -Wa,--noexecstack -fomit-frame-pointer -fno-strict-aliasing -DTERMIO -DPURIFY -Wall -fstack-protector  -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DWHIRLPOOL_ASM
OPENSSLDIR: "/etc/ssl"

It seems that the openssl was updated but still is using the old 1.0.0 library... any idea on how to fix this so that the system will be compliant with the latest 2016 Paypal security standards?

3
+50

I think the problem is that your Apache installation is unable to link the shared libraries of your new OpenSSL installation. Run the command ldd /usr/local/apache/modules/mod_ssl.so (with the apporpriate path to your mod_ssl.so). You'll see that mod_ssl.so is not linking to the libraries in /usr/local/ssl/lib

You have a couple options to fix the problem:

Option #1 - Link in the libraries:

Open /etc/ld.so.conf.d/local.conf for editing and add the following line: /usr/local/openssl/lib

Re-compile Apache (remember to make clean) and it should work.

If that doesn't work. You could also try specifying LDFLAGS directly with your configure command:

LDFLAGS=-L/usr/local/ssl/lib \ ./configure --with-included-apr --prefix=/usr/local/apache2 --enable-so     
--enable-rewrite --with-ssl=/usr/local/ssl --enable-ssl=shared
--enable-deflate --enable-expires --enable-headers

Option #2 - Upgrade the system OpenSSL:

Re-install OpenSSL with the config line ./config --prefix=/usr --openssldir=/usr/local/openssl shared

When the prefix is not specified in your config line, the OpenSSL installer will default to /usr/local/ssl.

Quick install instructions:

cd /usr/local/src
wget https://www.openssl.org/source/openssl-1.0.2-latest.tar.gz
tar -zxf openssl-1.0.2*
cd openssl-1.0.2*
./config --prefix=/usr --openssldir=/usr/local/openssl shared
make
make test
make install

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.