How to update Openssl to 1.1.2b?

Question

OpenSSL

Hey!
There is a vps with centos6 ispmanager5 Apache/2.2.15 nginx/1.12.2
Tried via yum update openssl, but only updated to 1.0.1e.
How to update to the latest version, you need to enable http/2

Answer 1

Well, there are ways, but guarantees are zero.
- Find a turnip where openssl assembled under el6 lies. To do this, it is necessary that there is someone who needs it, and this "someone" wants to assemble the package at least.
- Take the source and compile manually. This is the path of a masochist, because in el6, not only openssl is old - everything is about the age of the bucket 2.6 (and what did you want?). That is, you will have to collect all the dependencies that he wants.

Answer 2

For CentOS 6.2, I collected fresh at that time openssl and nginx. There was no need or desire to update the OS.
I compiled everything in a virtual machine, I did not place the results in rpm packages.
Packages required for compilation:

# yum install epel-release -y
# yum install file man mc p7zip tmux -y
# yum install cpp gcc gcc-c++ make libstdc++-devel pcre-devel zlib-devel -y

OpenSSL 1.1.0g build:

$ ./config \
enable-ec_nistp_64_gcc_128 \
no-deprecated \
no-filenames \
no-gost \
no-rc2 \
no-rc4 \
no-srp \
no-srtp \
no-ssl3 \
shared \
threads \
zlib-dynamic
$ make

# cp libcrypto.so.1.1 libssl.so.1.1 /usr/local/lib64
# cd /usr/local/lib64
# ln -s libcrypto.so.1.1 libcrypto.so
# ln -s libssl.so.1.1 libssl.so
# ldconfig /usr/local/lib64
# ldconfig -p

Для автоматического тестирования openssl 1.1.0g с помощью make test нужен Perl-модуль Test::More минимум 0.96, который идет с Perl v5.13.4.

# yum install patch
$ curl -L https://install.perlbrew.pl | bash
$ . ~/perl5/perlbrew/etc/bashrc
$ perlbrew available
$ perlbrew install perl-5.27.6
$ perlbrew list
$ perlbrew use perl-5.27.6
$ perl -v
$ perlbrew install-cpanm
$ cd ~/openssl-1.1.0g/
$ grep -r "/usr/bin/perl" ./
$ sed -i 's/\/usr\/bin\/perl/\/usr\/bin\/env perl/g' ./{Makefile,configdata.pm,test/recipes/80-test_cipherlist.t,test/README,Configurations/{unix-checker.pm,windows-checker.pm}}
$ make test

Сборка nginx 1.13.7

./configure \
--prefix=/usr/local/share/nginx \
--sbin-path=/usr/local/sbin/nginx \
--conf-path=/etc/nginx/nginx.conf \
--error-log-path=/var/log/nginx/error.log \
--pid-path=/var/run/nginx.pid \
--lock-path=/var/lock/subsys/nginx \
--user=nginx \
--group=nginx \
--with-threads \
--with-file-aio \
--http-log-path=/var/log/nginx/access.log \
--http-client-body-temp-path=/var/lib/nginx/tmp/client_body \
--http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi \
--http-proxy-temp-path=/var/lib/nginx/tmp/proxy \
--without-http_ssi_module \
--without-http_scgi_module \
--without-http_uwsgi_module \
--without-http_geo_module \
--without-http_split_clients_module \
--without-http_memcached_module \
--with-http_ssl_module \
--with-http_v2_module \
--with-http_realip_module \
--with-http_sub_module \
--with-http_auth_request_module \
--with-http_stub_status_module \
--with-http_gunzip_module \
--with-http_gzip_static_module \
--with-http_v2_module \
--with-cc-opt='-O2 -g -I ../openssl-OpenSSL_1_1_0g/include' \
--with-ld-opt="-L /usr/local/lib64" \

В файл /etc/nginx/conf.d/domain.ru.conf добавлены строки:

server {
    server_name domain.ru;

    listen 443 ssl http2;

    ssl_certificate            auth-acme/domain.ru.crt;
    ssl_certificate_key        auth-acme/domain.ru.key;
    ssl_session_cache          shared:SSLdsr:2m;
    ssl_session_timeout        15m;
    ssl_ciphers                HIGH:!aNULL:!CAMELLIA:!DSS:!MD5:!PSK:!RC4:+AES128:+AES256:RSA+3DES:+SSLv3;
    ssl_prefer_server_ciphers  on;
    ssl_ecdh_curve             secp384r1;
    add_header                 Strict-Transport-Security  "max-age=15552000";
    resolver                   1.1.1.1 8.8.8.8 ipv6=off;
    resolver_timeout           5s;
    ssl_stapling               on;
    ssl_stapling_verify        on;

    location /.well-known/acme-challenge/ {
        allow all;
        default_type plain/text;
        root /var/www/html/$server_name;
    }
   ...
}

Answer 3

Add additional repo to connect or assemble by hand.

Answer 4

In a dev environment, I recommend using https://mailtrap.io/. This is your case.
In a small prod, there is another mail service, there are many of them.

Answer 5

So in openserver, mail is added to userdata / temp