As announced ( OpenSSL Client Compatibility Changes for Let’s Encrypt Certificates ) expiration of DST Root CA X3 causing issues for clients with OpenSSL < 1.1.0. As there are still some very old Centos/RHEL 6 Servers (openssl-1.0.1e-58.el6_10.x86_64) out there (especially some of our VM Hosting/Hous…

@ Osiris - thx - it's working like a charm with the manually compiled RPMs! :wink: For the sake of completeness, here again the complete workflow to solve the DST Root CA X3 expiration problem with Centos / RHEL 6 ... yum install wget yum install krb5-devel zlib-devel lksctp-tools-devel util-linux…

Hi, i have (for me successfully) tried little bit more conservative approach on Centos 6. After normal 6.10 ca-certificates upgrade, which solved problem for me for NSS based apps, i found somewhere, that openssl (even Centos6 1.0.1) -trusted_first cli option works fine. So i created openssl-1.0.1e-…

This is the bit I can't figure, I've tried rpmbuild -bb ~/rpmbuild/SPECS/openssl.spec which has built the rpms, but then I get conflicts. Wish the explanation was a bit clearer for each step.

I can rpmbuild -bb ~/rpmbuild/SPECS/openssl.spec for example, which seems to create the various RPMs. It's the step after that...there are various rpms, and if I try and install them it comes up with various conflicts, and doesn't seem to update the .so file, so a bit confused. It would be helpful …

This looks like you built the packages on a CentOS 7 server and then copied them to a CentOS 6 server. They must be built on a CentOS 6 server. Yours seem compiled against a newer glibc version than CentOS 6 has available and have the 'el7' in the filename.

I can't give exact installation instructions for everyone because it somewhat depends on what you already have installed. You will need to add all the packages you need at the same time to avoid conflict messages as the packages are interdependent. Because this version of the package separated ope…

Woohoo! I did it too! Full list of commands on a "fresh" CentOS 6 Docker image: yum install wget yum install krb5-devel zlib-devel lksctp-tools-devel util-linux make gcc rpm-build curl -o openssl-1.0.2k-21.el7_9.src.rpm https://vault.centos.org/7.9.2009/updates/Source/SPackages/openssl-1.0.2k-21.el…

@Osiris The -devel package (for any package) contains just include files, only needed to build other packages depending on this one, not needed for regular operations. You can safely remove them. @alan3188 The dependency failures are because on CentOS 7 (where we took the spec file from), the open…

Thanks for the help folks, I still get a curious error when trying to update/install the rpm (existing latest openssl in centos 6 is 1.0.1e)... error: Failed dependencies: openssl-devel = 1.0.1e-58.el6_10 is needed by (installed) openssl-static-1.0.1e-58.el6_10.x86_64 However, yum install openssl…

You won't need to install the source RPM, but that message indicates that your existing version of openssl-static doesn't like that you are upgrading openssl-devel and trying to leave it back on the old version, so the correct fix is just to install openssl-static in the same command like you did!

RHEL/CentOS 6 OpenSSL client compatibility after DST Root CA X3 expiration

Help

joconcha October 4, 2021, 6:12pm 67

ok, they are here:

Index of /openssl-rhel6 both RPM and SRPMS

credits for @kstange and for me.

Topic		Replies	Views
RHEL/CentOS 7 OpenSSL client compatibility after new chain Help	44	17004	October 9, 2021
Openssl is unable to get local issuer certificate ever since DST Root X3 expired Help	29	23875	January 23, 2022
One of these certs is not like the others -DST Root CA X3 breaking antique hosts Help	14	1173	December 26, 2023
Help thread for DST Root CA X3 expiration (September 2021) Help	720	168940	November 3, 2022
Correct ca bundle to use Issuance Tech	70	12097	November 9, 2021

RHEL/CentOS 6 OpenSSL client compatibility after DST Root CA X3 expiration

Related topics