Apache – Use Different OpenSSL for Apache

apache-httpdcompilingdynamic-linkingopenssl

I'm compiling Apache from source, and staticly linking mod_ssl. I'm looking to use a different version of OpenSSL to the system-installed version. I would like to do this in a way that doesn't affect the rest of the system, which is CentOS, as I would prefer to not change the core system's SSL version, used by other installed software that will continue to be managed by the package manager.

How can I do this properly?

I've tried compiling Apache --with-ssl which works fine for compiling it, but then it doesn't find it when trying to run it.

./httpd: error while loading shared libraries: libssl.so.1.1: cannot open shared object file: No such file or directory

I'm thinking that perhaps I could set LD_LIBRARY_PATH when starting up Apache, which works fine, but not sure that's an appropriate approach. What's the recommended way to approach this? Is there a better way to add a directory for an alternative library search path?

Best Answer

First, you should get the desired version of OpenSSL and install it at a location where it will not interfere with your system version, e.g. /opt:

$ ./config \
    --prefix=/opt/openssl-VERSION \
    --openssldir=/opt/openssl-VERSION
$ make
$ sudo make install

Next, get the latest Apache 2.4.x, APR and APR-Util libraries. You will need to unpack all three packages into the same source tree, with the latter two in the location where Apache expects them. For example:

$ tar zxvf httpd-VERSION.tar.gz
$ cd httpd-VERSION/srclib/
$ tar zxvf ../../apr-VERSION.tar.gz
$ ln -s apr-VERSION/ apr
$ tar zxvf ../../apr-util-VERSION.tar.gz
$ ln -s apr-util-VERSION/ apr-util

Then, configure and install Apache. The mod_ssl module will be compiled statically, with all other modules dynamically, like this:

$ ./configure \
    --prefix=/opt/httpd \
    --with-included-apr \
    --enable-ssl \
    --with-ssl=/opt/openssl-VERSION \
    --enable-ssl-staticlib-deps \
    --enable-mods-static=ssl
$ make
$ sudo make install
Related Question