Mdthbs

I have built Apache 2.4.25 with OpenSSL 1.0.2 successfully.

But Because of some security holes we found in our Internal tests,
I have been asked to patch Openssl with the latest version.
So I am trying to build Apache httpd 2.4.25 with OpenSSL 1.1.0c (or) 1.1.0d

My Environments

lsb_release -a

Distributor ID: RedHatEnterpriseServer

Description:    Red Hat Enterprise Linux Server release 5.11 (Tikanga)

Release:        5.11

Codename:       Tikanga



Perl:           5.24

PCRE:           8.38

APR:            1.5.2

APR-util:       1.5.4

OpenSSL:        1.1.0c / 1.1.0d

All the above Apache dependencies have been successfully built and installed

Apache 2.4.25 - Installation steps

cd /my/softwares

tar -xvf httpd-2.4.25.tar -C /my/build/



cd /my/build/httpd-2.4.25/



./configure --prefix=/my/apache-httpd-2.4.25 

    --with-pcre=/my/dependencies/pcre-8.38/ 

    --with-apr=/my/dependencies/apr-1.5.2 

    --with-apr-util=/my/dependencies/apr-util-1.5.4 

    --enable-ssl 

    --with-ssl=/usr/local/ssl-1.1.0c 

    --enable-ssl-staticlib-deps 

    --enable-mods-static=ssl



make // see below errors

make install

I am getting the below error when building Apache from source with open ssl.
Please help me in the right directions.

ssl_engine_init.c: In function 'make_dh_params':

ssl_engine_init.c:61: error: dereferencing pointer to incomplete type

ssl_engine_init.c:62: error: dereferencing pointer to incomplete type

ssl_engine_init.c:63: error: dereferencing pointer to incomplete type

ssl_engine_init.c:63: error: dereferencing pointer to incomplete type

ssl_engine_init.c: In function 'ssl_init_ctx_protocol':

ssl_engine_init.c:519: warning: 'TLSv1_client_method' is deprecated (declared at /usr/local/ssl-1.1.0c/include/openssl/ssl.h:1598)

ssl_engine_init.c:520: warning: 'TLSv1_server_method' is deprecated (declared at /usr/local/ssl-1.1.0c/include/openssl/ssl.h:1597)

ssl_engine_init.c:525: warning: 'TLSv1_1_client_method' is deprecated (declared at /usr/local/ssl-1.1.0c/include/openssl/ssl.h:1604)

ssl_engine_init.c:526: warning: 'TLSv1_1_server_method' is deprecated (declared at /usr/local/ssl-1.1.0c/include/openssl/ssl.h:1603)

ssl_engine_init.c:530: warning: 'TLSv1_2_client_method' is deprecated (declared at /usr/local/ssl-1.1.0c/include/openssl/ssl.h:1610)

ssl_engine_init.c:531: warning: 'TLSv1_2_server_method' is deprecated (declared at /usr/local/ssl-1.1.0c/include/openssl/ssl.h:1609)

ssl_engine_init.c: In function 'ssl_init_ctx_session_cache':

ssl_engine_init.c:641: warning: passing argument 2 of 'SSL_CTX_sess_set_get_cb' from incompatible pointer type

ssl_engine_init.c: In function 'use_certificate_chain':

ssl_engine_init.c:861: warning: implicit declaration of function 'BIO_s_file_internal'

ssl_engine_init.c:861: warning: passing argument 1 of 'BIO_new' makes pointer from integer without a cast

ssl_engine_init.c: In function 'ssl_init_server_certs':

ssl_engine_init.c:1201: error: dereferencing pointer to incomplete type

make[3]: *** [ssl_engine_init.lo] Error 1

make[3]: Leaving directory `/my/build/httpd-2.4.25/modules/ssl'

make[2]: *** [all-recursive] Error 1

make[2]: Leaving directory `/my/build/httpd-2.4.25/modules/ssl'

make[1]: *** [all-recursive] Error 1

make[1]: Leaving directory `/my/build/httpd-2.4.25/modules'

make: *** [all-recursive] Error 1

Why do you need to build Apache with statically linked ssl libraries?
It is a fairly bad idea in my opinion.
With dynamically linked libraries, you can just upgrade ssl when needed.
With static ones you will need to recompile apache every time ssl gets patched

From one of the online users comments

"As of now, with the latest version Apache HTTPD 2.4.25, the 2.4 branch is not yet compatible with Openssl 1.1.x, So have to stick with the latest 1.0.2x and stay up to date on security issues."

"There is no official statement, since OpenSSL 1.1.x became stable pratically "yesterday" there haven't been time and time to adapt 2.4 branch to it, all of this you can read about mainly in the dev and user httpd mailing list"