5

I am using centos 7.2, I will intall Nginx-CT,and it needs OpenSSL 1.0.2,the current version is as follow:

[root@i001 ~]# rpm -qa|grep openssl
openssl-libs-1.0.1e-51.el7_2.4.x86_64
openssl-devel-1.0.1e-51.el7_2.4.x86_64
openssl-1.0.1e-51.el7_2.4.x86_64

I tried to download SRPM package in fedora repertory,

openssl-1.0.2d-2.fc23.src.rpm

rebuild it and install, but there is something wrong,

[root@i001 ~]# yum update openssl
Loaded plugins: axelget, langpacks
No metadata available for base
No metadata available for dockerrepo
No metadata available for elrepo
No metadata available for epel
No metadata available for extras
No metadata available for local
No metadata available for mariadb
No metadata available for nginx
No metadata available for remi-php70
No metadata available for remi-php70-test
No metadata available for remi-safe
No metadata available for salt-2015.8
No metadata available for updates
Resolving Dependencies
--> Running transaction check
---> Package openssl.x86_64 1:1.0.1e-51.el7_2.4 will be updated
---> Package openssl.x86_64 1:1.0.2d-2.el7.centos will be an update
--> Processing Dependency: openssl-libs(x86-64) = 1:1.0.2d-2.el7.centos for package: 1:openssl-1.0.2d-2.el7.centos.x86_64
--> Processing Dependency: libcrypto.so.10(OPENSSL_1.0.2)(64bit) for package: 1:openssl-1.0.2d-2.el7.centos.x86_64
--> Running transaction check
---> Package openssl-libs.x86_64 1:1.0.1e-51.el7_2.4 will be updated
--> Processing Dependency: openssl-libs(x86-64) = 1:1.0.1e-51.el7_2.4 for package: 1:openssl-devel-1.0.1e-51.el7_2.4.x86_64
---> Package openssl-libs.x86_64 1:1.0.2d-2.el7.centos will be an update
--> Processing Dependency: crypto-policies for package: 1:openssl-libs-1.0.2d-2.el7.centos.x86_64
--> Running transaction check
---> Package openssl-devel.x86_64 1:1.0.1e-51.el7_2.4 will be updated
---> Package openssl-devel.x86_64 1:1.0.2d-2.el7.centos will be an update
---> Package openssl-libs.x86_64 1:1.0.2d-2.el7.centos will be an update
--> Processing Dependency: crypto-policies for package: 1:openssl-libs-1.0.2d-2.el7.centos.x86_64
--> Finished Dependency Resolution
Error: Package: 1:openssl-libs-1.0.2d-2.el7.centos.x86_64 (local)
           Requires: crypto-policies
 You could try using --skip-broken to work around the problem
 You could try running: rpm -Va --nofiles --nodigest

What should I do?

Improve this question
6
  • Maybe edit your question and explain why you are trying to upgrade openssl to a version that isn't supported on your platform? Commented Apr 8, 2016 at 17:58
  • You probably don't want to do it this way. You're installing a lot of third party repos which is just asking for your base packages to eventually be polluted. I would recommend removing as many of those other repos as you can (without forcing yourself to compile everything from source). Your repositories should only ever add packages to the system and not replace core packages. If a repo replaces a system package, it's a poorly maintained repo. Commented Apr 8, 2016 at 18:55
  • You're much better off compiling both from source and just referencing the alternate openssl installation in your compile of nginx-ct. The guide is for Debian but you'll be able to find similar steps for compiling on CentOS. Commented Apr 8, 2016 at 18:56
  • Also, I wouldn't really download a Fedora SRPM. That would be useful if this were a fedora system and you were just trying to compile it from source but often they'll include patches that aren't relevant to other systems. Not to mention, it'll likely try to install over the system's instance of openssl rather than beside it, which is what you want. Commented Apr 8, 2016 at 18:58
  • You only need to upgrade to a later version if that version provides a feature that isn't in your current version. There is no need to upgrade to mitigate the various security issues that sometimes turns up within openSSL (or any package) as the package maintainers add security patches to the currently supported version. Commented Apr 8, 2016 at 19:58

2 Answers 2

Reset to default
5

First, let me say that garethTheRed and Bratchley are right in that the package of OpenSSL you're trying to install is not supported on CentOS, and doing so is not recommended. Trying to do this could cause problems on your system.

If you absolutely must have this installed... As I understand it, you're trying to install nginx-ct, which requires OpenSSL 1.0.2 or higher because of its need for SSL_CTX_add_server_custom_ext and SSL_CTX_set_signed_cert_timestamp_list.

Using yum

Using packages from other unsupported repos for your system is a bad idea, as pointed out by others. From the looks of your yum output, it's complaining about a dependency on the crypto-policies package (required by openssl-libs-1.0.2d-2). You could try to install the crypto-policies package (also from the Fedora 23 repo) first.

Compiling from source

As Bratchley pointed out in this comment, you can try to compile nginx with a specific version of OpenSSL from source. Here are the updated starting commands from that tutorial:

# Install dependencies
sudo yum install unzip gcc pcre-devel zlib-devel make golang

# Grab needed files, correct as of 2016-04-08
wget https://www.openssl.org/source/openssl-1.0.2g.tar.gz
wget http://nginx.org/download/nginx-1.9.14.tar.gz
wget -O nginx-ct.zip https://github.com/grahamedgecombe/nginx-ct/archive/master.zip
tar zxf openssl-1.0.2g.tar.gz
tar zxf nginx-1.9.14.tar.gz
unzip nginx-ct.zip

# Build nginx with openssl 1.0.2 and CT module
cd nginx-1.9.14/
./configure --with-http_ssl_module \
    --with-openssl=`realpath ../openssl-1.0.2g` \
    --add-module=`realpath ../nginx-ct-master`
make  # NOTE: when I tried building with -jN for speedup I encountered linker issues
sudo make install
cd ..

The rest of the commands in that tutorial should be able to be followed as-is.

A last alternative

Alternatively, you could try to use BoringSSL, since nginx-ct supports that, though it seems you would have to build it from source.

Improve this answer
1

As an alternative direction consider installing these tools inside a docker container. That way you can use a different Linux distribution (like Fedora or Ubuntu) and run just these two inside an isolated environment in such a way that they cannot affect the rest of your system by enforcing 'non-standard' versions of these tools.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.