Hi, i have (for me successfully) tried little bit more conservative approach on Centos 6. After normal 6.10 ca-certificates upgrade, which solved problem for me for NSS based apps, i found somewhere, that openssl (even Centos6 1.0.1) -trusted_first cli option works fine. So i created openssl-1.0.1e-58.pd1trfir.el6.src.rpm with this flag default on primarily for me. If you find this version useful, you can see it.. It is simply based on crypto/x509/x509_vfy.c patch:
-
if (ctx->param->flags & X509_V_FLAG_TRUSTED_FIRST)
+
if (/* Dufek - always - ctx->param->flags & */ X509_V_FLAG_TRUSTED_FIRST)
Sorry for maybe problematic typography here in discussion, suppose the key info is shown here.
This is the bit I can't figure, I've tried rpmbuild -bb ~/rpmbuild/SPECS/openssl.spec which has built the rpms, but then I get conflicts. Wish the explanation was a bit clearer for each step.
I can rpmbuild -bb ~/rpmbuild/SPECS/openssl.spec for example, which seems to create the various RPMs.
It's the step after that...there are various rpms, and if I try and install them it comes up with various conflicts, and doesn't seem to update the .so file, so a bit confused. It would be helpful if you could expand on the exact steps you did after the patch and build.
Thanks for the help.
This looks like you built the packages on a CentOS 7 server and then copied them to a CentOS 6 server. They must be built on a CentOS 6 server. Yours seem compiled against a newer glibc version than CentOS 6 has available and have the 'el7' in the filename.
I can't give exact installation instructions for everyone because it somewhat depends on what you already have installed. You will need to add all the packages you need at the same time to avoid conflict messages as the packages are interdependent. Because this version of the package separated openssl-libs from the main package you will definitely need at least this one. You can see what's already installed by running rpm -qa openssl\*. If you have i686 packages installed as well, you will need to remove them or cross compile openssl for i686 as well, but we are getting deeper and deeper into the weeds and it's impossible to elucidate every corner case in this thread.
For me I had to do: cd ~/rpmbuild/RPMS/x86_64/; rpm -Uhv openssl-1.0.2k-21.el6.x86_64.rpm openssl-libs-1.0.2k-21.el6.x86_64.rpm openssl-devel-1.0.2k-21.el6.x86_64.rpm but this may not be the same for everyone.
@Osiris The -devel package (for any package) contains just include files, only needed to build other packages depending on this one, not needed for regular operations. You can safely remove them.
@alan3188 The dependency failures are because on CentOS 7 (where we took the spec file from), the openssl package is split into "openssl" and "openssl-libs", but on CentOS 6 you had only "openssl". So you need to explicitly install the -libs package at the same time.
(which is why I suggested to merge them back into one, but that's another bit more work on the spec file. once you get it installed, it doesn't matter anymore.)
You won't need to install the source RPM, but that message indicates that your existing version of openssl-static doesn't like that you are upgrading openssl-devel and trying to leave it back on the old version, so the correct fix is just to install openssl-static in the same command like you did!
For all interested parties. I've modified openssl.spec to incorporate shared files back into monolitic RPM file to match EL6 package contents.
URL for corresponding binary and source packages (openssl and ca-certificates) + openssl.spec is https://server-support.co/openssl-el6/
For openssl update needed to remove a python-libs-2.6.6-68.el6_10.i686 package from 6.10 @updates repo, as it had a fixed dependency that prevented the openssl install. It removed cleanly though, nothing using it apparently.
yum remove python-libs-2.6.6-68.el6_10.i686
due to:
error: Failed dependencies:
libcrypto.so.10 is needed by (installed) python-libs-2.6.6-68.el6_10.i686
libcrypto.so.10(libcrypto.so.10) is needed by (installed) python-libs-2.6.6-68.el6_10.i686
libssl.so.10 is needed by (installed) python-libs-2.6.6-68.el6_10.i686
libssl.so.10(libssl.so.10) is needed by (installed) python-libs-2.6.6-68.el6_10.i686
For the certificates update, I needed following changes:
Add "-p": mkdir -p /dl/ca-cert; cd /dl/ca-cert;
Add "cd ~/rpmbuild/SPECS" before "rpmbuild -bb ca-certificates.spec"
Signed up just to say thanks. The comments in this thread are pure gold. @futureweb incorporated the comments from many in this thread into a perfect post on building the openssl & ca-certificate packages in post #73. I happened to load these into Spacewalk, and yum is smart enough to install the openssl-libs on upgrade of openssl.
Since openssl apparantly doesn't check the self-signature on root CA's, you can simply alter the expiration date of DST Root CA X3, and it will be trusted again. The following command fudges the expiration date to 30 September 2024 (the end-date of the ISRG Root X1 cross-signature) directly in the PEM-encoded certificate:
sudo sed -i s/xMDkzMDE0MDExNVow/0MDkzMDE4MTQwM1ow/ /etc/pki/tls/certs/ca-bundle.crt
no openssl upgrade needed!