Eu tenho servidor no Debian Jessie com OpenSSL 1.0.1t 3 de maio de 2016.
Eu queria atualizar o OpenSSL para a versão 1.0.2 e definir os parâmetros DH personalizados .
Então adicionei backports a sources.list e instalei a nova versão do OpenSSL com
apt-get -t jessie-backports install openssl
Após a instalação, reiniciei o Apache, mas no phpinfo, posso ver a versão errada do cabeçalho do OpenSSL:
PHP Version 7.0.17-1~dotdeb+8.1
OpenSSL Library Version OpenSSL 1.0.2k 26 Jan 2017
OpenSSL Header Version OpenSSL 1.0.1t 3 May 2016
Openssl default config /usr/lib/ssl/openssl.cnf
Como posso consertar isso?
Editar - mais informações para Stephen Kitt
Algo está errado e cabeçalho é minha única pista.
Apache:
apachectl -V
Server version: Apache/2.4.10 (Debian)
Server built: Feb 24 2017 18:40:28
Server's Module Magic Number: 20120211:37
Server loaded: APR 1.5.1, APR-UTIL 1.5.4
Compiled using: APR 1.5.1, APR-UTIL 1.5.4
Architecture: 64-bit
Server MPM: prefork
threaded: no
forked: yes (variable process count)
Server compiled with....
-D APR_HAS_SENDFILE
-D APR_HAS_MMAP
-D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)
-D APR_USE_SYSVSEM_SERIALIZE
-D APR_USE_PTHREAD_SERIALIZE
-D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
-D APR_HAS_OTHER_CHILD
-D AP_HAVE_RELIABLE_PIPED_LOGS
-D DYNAMIC_MODULE_LIMIT=256
-D HTTPD_ROOT="/etc/apache2"
-D SUEXEC_BIN="/usr/lib/apache2/suexec"
-D DEFAULT_PIDLOG="/var/run/apache2.pid"
-D DEFAULT_SCOREBOARD="logs/apache_runtime_status"
-D DEFAULT_ERRORLOG="logs/error_log"
-D AP_TYPES_CONFIG_FILE="mime.types"
-D SERVER_CONFIG_FILE="apache2.conf"
OpenSSL
openssl version -a
OpenSSL 1.0.2k 26 Jan 2017
built on: reproducible build, date unspecified
platform: debian-amd64
options: bn(64,64) rc4(16x,int) des(idx,cisc,16,int) blowfish(idx)
compiler: gcc -I. -I.. -I../include -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -Wl,-z,relro -Wa,--noexecstack -Wall -DMD32_REG_T=int -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM
OPENSSLDIR: "/usr/lib/ssl"
Depois de adicionar DH params ao ssl.conf, estou recebendo erros
SSLOpenSSLConfCmd DHParameters /etc/ssl/private/dhparams.pem
Reinicie o Apache
service apache2 restart
Job for apache2.service failed. See 'systemctl status apache2.service' and 'journalctl -xn' for details.
systemctl status apache2.service
● apache2.service - LSB: Apache2 web server
Loaded: loaded (/etc/init.d/apache2)
Drop-In: /lib/systemd/system/apache2.service.d
└─forking.conf
Active: failed (Result: exit-code) since wto 2017-03-28 16:25:26 CEST; 11s ago
Process: 43828 ExecStop=/etc/init.d/apache2 stop (code=exited, status=0/SUCCESS)
Process: 51393 ExecReload=/etc/init.d/apache2 reload (code=exited, status=0/SUCCESS)
Process: 43857 ExecStart=/etc/init.d/apache2 start (code=exited, status=1/FAILURE)
mar 28 16:25:26 domain.com apache2[43857]: Starting web server: apache2 failed!
mar 28 16:25:26 domain.com apache2[43857]: The apache2 configtest failed. ... (warning).
mar 28 16:25:26 domain.com apache2[43857]: Output of config test was:
mar 28 16:25:26 domain.com apache2[43857]: AH00526: Syntax error on line 54 of /etc/apache2/mods-enabled/ssl.conf:
mar 28 16:25:26 domain.com apache2[43857]: Invalid command 'SSLOpenSSLConfCmd', perhaps misspelled or defined by a module not included in the server configuration
mar 28 16:25:26 domain.com apache2[43857]: Action 'configtest' failed.
mar 28 16:25:26 domain.com apache2[43857]: The Apache error log may have more information.
mar 28 16:25:26 domain.com systemd[1]: apache2.service: control process exited, code=exited status=1
mar 28 16:25:26 domain.com systemd[1]: Failed to start LSB: Apache2 web server.
mar 28 16:25:26 domain.com systemd[1]: Unit apache2.service entered failed state.