OpenSSL 1.1.0 導入

はじめに

WordPressの環境をApache 2.4 + MySQL 5.7 + PHP7  で構築するにあたり、Apache 2.4 をHTTP2に対応させるため、OpenSSL 1.1.0を 採用します。
またデフォルトでインストールされているOpenSSLは削除した場合の影響が大きそうなのでそのまま残します。

 

対象バージョン

	バージョン
OpenSSL	1.1.0g

2018/04/19 現在 最新1.1.0hが公開されています。最新バージョンは公式サイトで確認してください。
https://www.openssl.org/

サーバ環境

	バージョン
CentOS 7	CentOS Linux release 7.4.1708 (Core)

 

インストールされているバージョン確認

# rpm -qa | grep openssl
openssl-1.0.2k-8.el7.x86_64
openssl-devel-1.0.2k-8.el7.x86_64
openssl-libs-1.0.2k-8.el7.x86_64

 

CentOS 7  デフォルトのOpenSSLバージョン確認

# openssl version
OpenSSL 1.0.2k-fips 26 Jan 2017

 

削除した場合の依存関係を確認

確認だけで今回は削除しません。

# rpm -e openssl-1.0.2k-8.el7.x86_64 --test
error: Failed dependencies:
 /usr/bin/openssl is needed by (installed) authconfig-6.2.8-30.el7.x86_64

# rpm -e openssl-devel-1.0.2k-8.el7.x86_64 --test

# rpm -e openssl-libs-1.0.2k-8.el7.x86_64 --test
error: Failed dependencies:
 libcrypto.so.10()(64bit) is needed by (installed) coreutils-8.22-18.el7.x86_64
 libcrypto.so.10()(64bit) is needed by (installed) krb5-libs-1.15.1-8.el7.x86_64
 libcrypto.so.10()(64bit) is needed by (installed) python-libs-2.7.5-58.el7.x86_64
 ...(省略)...

 

事前準備

make testでエラーが出るため、perlのパッケージを入れておく

# yum install perl-core

 

ダウンロード

/usr/local/src/で実行

# wget https://www.openssl.org/source/openssl-1.1.0g.tar.gz

 

展開

# tar zxvf openssl-1.1.0g.tar.gz

 

展開したディレクトリに移動

# cd /usr/local/src/openssl-1.1.0g/

 

ビルド・インストール

ハマりポイント。make testに特権ユーザで実行されていないことを確認する項目があり、rootで実行するとエラーになります。

Test Summary Report
-------------------
../test/recipes/40-test_rehash.t (Wstat: 256 Tests: 5 Failed: 1)
 Failed test: 4
 Non-zero exit status: 1
Files=95, Tests=556, 43 wallclock secs ( 0.43 usr 0.10 sys + 32.13 cusr 12.25 csys = 44.91 CPU)
Result: FAIL
make[1]: *** [_tests] Error 1
make[1]: Leaving directory `/usr/local/src/openssl-1.1.0g'
make: *** [tests] Error 2

 

一般ユーザで実行できるようにパーミッションも変更しておき、make installだけrootで実行。（手順は以下の通り）

$ sudo tar zxvf openssl-1.1.0g.tar.gz

$ sudo chown -R  <UserName> openssl-1.1.0g

$ cd openssl-1.1.0g

$ ./config --prefix=/usr/local/openssl-1.1.0g shared zlib

$ make

$ make test

make depend && make _tests
make[1]: Entering directory `/usr/local/src/openssl-1.1.0g'
make[1]: Leaving directory `/usr/local/src/openssl-1.1.0g'
make[1]: Entering directory `/usr/local/src/openssl-1.1.0g'
( cd test; \
 mkdir -p test-runs; \
 SRCTOP=../. \
 BLDTOP=../. \
 RESULT_D=test-runs \
 PERL="/usr/bin/perl" \
 EXE_EXT= \
 OPENSSL_ENGINES=`cd .././engines; pwd` \
 OPENSSL_DEBUG_MEMORY=on \
 /usr/bin/perl .././test/run_tests.pl )
../test/recipes/01-test_abort.t ............ ok
../test/recipes/01-test_sanity.t ........... ok
../test/recipes/01-test_symbol_presence.t .. ok
../test/recipes/02-test_ordinals.t ......... ok
../test/recipes/03-test_exdata.t ........... ok
../test/recipes/03-test_ui.t ............... ok
../test/recipes/04-test_pem.t .............. ok
../test/recipes/05-test_bf.t ............... ok
../test/recipes/05-test_cast.t ............. ok
../test/recipes/05-test_des.t .............. ok
../test/recipes/05-test_hmac.t ............. ok
../test/recipes/05-test_idea.t ............. ok
../test/recipes/05-test_md2.t .............. skipped: md2 is not supported by this OpenSSL build
../test/recipes/05-test_md4.t .............. ok
../test/recipes/05-test_md5.t .............. ok
../test/recipes/05-test_mdc2.t ............. ok
../test/recipes/05-test_rand.t ............. ok
../test/recipes/05-test_rc2.t .............. ok
../test/recipes/05-test_rc4.t .............. ok
../test/recipes/05-test_rc5.t .............. skipped: rc5 is not supported by this OpenSSL build
../test/recipes/05-test_rmd.t .............. ok
../test/recipes/05-test_sha1.t ............. ok
../test/recipes/05-test_sha256.t ........... ok
../test/recipes/05-test_sha512.t ........... ok
../test/recipes/05-test_wp.t ............... ok
../test/recipes/10-test_bn.t ............... ok
../test/recipes/10-test_exp.t .............. ok
../test/recipes/15-test_dh.t ............... ok
../test/recipes/15-test_dsa.t .............. ok
../test/recipes/15-test_ec.t ............... ok
../test/recipes/15-test_ecdsa.t ............ ok
../test/recipes/15-test_genrsa.t ........... ok
../test/recipes/15-test_rsa.t .............. ok
../test/recipes/15-test_rsapss.t ........... ok
../test/recipes/20-test_enc.t .............. ok
../test/recipes/20-test_passwd.t ........... ok
../test/recipes/25-test_crl.t .............. ok
../test/recipes/25-test_d2i.t .............. ok
../test/recipes/25-test_pkcs7.t ............ ok
../test/recipes/25-test_req.t .............. ok
../test/recipes/25-test_sid.t .............. ok
../test/recipes/25-test_verify.t ........... ok
../test/recipes/25-test_x509.t ............. ok
../test/recipes/30-test_afalg.t ............ skipped: test_afalg not supported for this build
../test/recipes/30-test_engine.t ........... ok
../test/recipes/30-test_evp.t .............. ok
../test/recipes/30-test_evp_extra.t ........ ok
../test/recipes/30-test_pbelu.t ............ ok
../test/recipes/40-test_rehash.t ........... ok
../test/recipes/60-test_x509_store.t ....... ok
../test/recipes/70-test_asyncio.t .......... ok
../test/recipes/70-test_bad_dtls.t ......... ok
../test/recipes/70-test_clienthello.t ...... ok
../test/recipes/70-test_packet.t ........... ok
../test/recipes/70-test_sslcbcpadding.t .... ok
../test/recipes/70-test_sslcertstatus.t .... ok
../test/recipes/70-test_sslextension.t ..... ok
../test/recipes/70-test_sslmessages.t ...... ok
../test/recipes/70-test_sslrecords.t ....... ok
../test/recipes/70-test_sslsessiontick.t ... ok
../test/recipes/70-test_sslskewith0p.t ..... ok
../test/recipes/70-test_sslvertol.t ........ ok
../test/recipes/70-test_tlsextms.t ......... ok
../test/recipes/70-test_verify_extra.t ..... ok
../test/recipes/80-test_ca.t ............... ok
../test/recipes/80-test_cipherlist.t ....... ok
../test/recipes/80-test_cms.t .............. ok
../test/recipes/80-test_ct.t ............... ok
../test/recipes/80-test_dane.t ............. ok
../test/recipes/80-test_dtls.t ............. ok
../test/recipes/80-test_dtlsv1listen.t ..... ok
../test/recipes/80-test_ocsp.t ............. ok
../test/recipes/80-test_pkcs12.t ........... ok
../test/recipes/80-test_ssl_new.t .......... ok
../test/recipes/80-test_ssl_old.t .......... ok
../test/recipes/80-test_ssl_test_ctx.t ..... ok
../test/recipes/80-test_sslcorrupt.t ....... ok
../test/recipes/80-test_tsa.t .............. ok
../test/recipes/80-test_x509aux.t .......... ok
../test/recipes/90-test_async.t ............ ok
../test/recipes/90-test_bio_enc.t .......... ok
../test/recipes/90-test_bioprint.t ......... ok
../test/recipes/90-test_constant_time.t .... ok
../test/recipes/90-test_fuzz.t ............. ok
../test/recipes/90-test_gmdiff.t ........... ok
../test/recipes/90-test_heartbeat.t ........ skipped: heartbeats is not supported by this OpenSSL build
../test/recipes/90-test_ige.t .............. ok
../test/recipes/90-test_memleak.t .......... ok
../test/recipes/90-test_p5_crpt2.t ......... ok
../test/recipes/90-test_secmem.t ........... ok
../test/recipes/90-test_shlibload.t ........ ok
../test/recipes/90-test_srp.t .............. ok
../test/recipes/90-test_sslapi.t ........... ok
../test/recipes/90-test_threads.t .......... ok
../test/recipes/90-test_v3name.t ........... ok
All tests successful.
Files=95, Tests=556, 43 wallclock secs ( 0.41 usr 0.12 sys + 31.72 cusr 12.14 csys = 44.39 CPU)
Result: PASS
make[1]: Leaving directory `/usr/local/src/openssl-1.1.0g'

# cd /usr/local/src/openssl-1.1.0g/
# make install

 

シンボリックリンク作成

古いOpenSSLは残しておく。今後バージョンアップの際、リンク張替えだけで済ませるためシンボリックリンクを作成する。

# cd /usr/local/
# ln -s /usr/local/openssl-1.1.0g openssl

# ls -l
total 0
drwxr-xr-x. 2 root root 6 Nov 6 2016 bin
drwxr-xr-x. 2 root root 6 Nov 6 2016 etc
drwxr-xr-x. 2 root root 6 Nov 6 2016 games
drwxr-xr-x. 2 root root 6 Nov 6 2016 include
drwxr-xr-x. 2 root root 6 Nov 6 2016 lib
drwxr-xr-x. 2 root root 6 Nov 6 2016 lib64
drwxr-xr-x. 2 root root 6 Nov 6 2016 libexec
lrwxrwxrwx 1 root root 25 Jan 17 09:23 openssl -> /usr/local/openssl-1.1.0g
drwxr-xr-x 7 root root 67 Jan 17 09:20 openssl-1.1.0g
drwxr-xr-x. 2 root root 6 Nov 6 2016 sbin
drwxr-xr-x. 5 root root 49 Dec 21 13:09 share
drwxr-xr-x. 3 root root 158 Jan 17 08:58 src

 

ライブラリにパスが通っていないため、まだ実行できない。

# /usr/local/openssl/bin/openssl version
/usr/local/openssl/bin/openssl: error while loading shared libraries: libssl.so.1.1: cannot open shared object file: No such file or directory

 

ld.so.confにライブラリのパスを追加

# vi /etc/ld.so.conf
include ld.so.conf.d/*.conf
# 以下追加
/usr/local/openssl/lib

 

ライブラリキャッシュファイル更新

# ldconfig

 

確認

# ldconfig -v | grep ssl
ldconfig: Can't stat /libx32: No such file or directory
ldconfig: Path `/usr/lib' given more than once
ldconfig: Path `/usr/lib64' given more than once
ldconfig: Can't stat /usr/libx32: No such file or directory
/usr/local/openssl/lib:
 libssl.so.1.1 -> libssl.so.1.1
 libssl3.so -> libssl3.so
 libssl.so.10 -> libssl.so.1.0.2k

 

ソースからインストールしたOpenSSLのバージョン確認（フルパス）

# /usr/local/openssl/bin/openssl version
OpenSSL 1.1.0g 2 Nov 2017

 

パスの追加

優先順位は先頭からのため、$PATHのあとに/usr/local/openssl/binを適用すると、古い方のOpenSSLが参照されるため注意。

vi /etc/profile

export PATH=/usr/local/openssl/bin:$PATH

 

ソースからインストールしたOpenSSLのバージョン確認

# openssl version
OpenSSL 1.1.0g 2 Nov 2017

 

 

参考

OpenSSLをソースからビルドしてNginxで使用する
OpenSSL バージョンアップ後も旧バージョンが居座り続ける問題
OpenSSLのインストール
OpenSSL "make test" でのエラー (Ubuntu 16.04)
openssl-1.1.0 インストール
OpenSSL(1.0.x)をインストールする（ソースからコンパイル）for CentOS 7.4
共有ライブラリへパスを通す