How to upgrade OpenSSL in CentOS 6.5 / Linux / Unix from source?

Question

How do I upgrade OpenSSL in CentOS 6.5?

I have used these commands, but nothings happens:

 cd /usr/src  wget http://www.openssl.org/source/openssl-1.0.1g.tar.gz  tar -zxf openssl-1.0.1g.tar.gz  cd openssl-1.0.1g  ./config  make  make test  make install  cd /usr/src  rm -rf openssl-1.0.1g.tar.gz  rm -rf openssl-1.0.1g 

After using this command, I get the old version

openssl version 

Answer 1

The fix for the heartbleed vulnerability has been backported to 1.0.1e-16 by Red Hat for Enterprise Linux see, and this is therefore the official fix that CentOS ships.

Replacing OpenSSL with the latest version from upstream (i.e. 1.0.1g) runs the risk of introducing functionality changes which may break compatibility with applications/clients in unpredictable ways, causes your system to diverge from RHEL, and puts you on the hook for personally maintaining future updates to that package. By replacing openssl using a simple make config && make && make install means that you also lose the ability to use rpm to manage that package and perform queries on it (e.g. verifying all the files are present and haven't been modified or had permissions changed without also updating the RPM database).

I'd also caution that crypto software can be extremely sensitive to seemingly minor things like compiler options, and if you don't know what you're doing, you could introduce vulnerabilities in your local installation.

Answer 2

./config --prefix=/usr --openssldir=/usr/local/openssl shared 

Try this config line instead to overwrite the default. It installs to prefix /usr/local/ssl by default in your setup when you leave off the prefix. You probably have "/usr/local/ssl/bin/openssl" instead of overwriting /usr/bin/openssl. You can also use /usr/local for prefix instead, but you would need to adjust your path accordingly if that is not already on your path. Here is the INSTALL documentation:

  $ ./config   $ make   $ make test   $ make install   [If any of these steps fails, see section Installation in Detail below.]  This will build and install OpenSSL in the default location, which is (for historical reasons) /usr/local/ssl. If you want to install it anywhere else, run config like this:    $ ./config --prefix=/usr/local --openssldir=/usr/local/openssl 

https://github.com/openssl/openssl/blob/master/INSTALL http://heartbleed.com/