Is it possible to enable TLSv1.3 currently about httpd24u HOT 7 OPEN

IUS isn't interested in maintaining openssl packages (see this issue for details).

However, it appears that someone else backported RHEL8's openssl 1.1.1c to EPEL7 as openssl11. I'd be happy to review and merge a pull request that implements building httpd24u against openssl11-devel.

from httpd24u.

Just a heads up. I am going to try the EPEL OpenSSL 1.1.1c after I get the 2.4.46 build done. It should be simply installing the OpenSSL package, pointing the configure script to use it and rebuilding the httpd rpm ... "should".

from httpd24u.

@mobeigi - short answer: No

Longer answer, they link against the system version of OpenSSL, so TLS 1.2 is as high as you get. I would also love to see IUS build OpenSSL 1.1.1 (& 3 when available) to support better/future algorithms. Then they could link httpd against that.

from httpd24u.

Status update: I have a pull request in for the initial upgrade to 2.4.46-1, once we get that in I will add the commit for OpenSSL 1.1. (hopefully 2.4.46-2). I have this running on a test system now!

from httpd24u.

@carlwgeorge - I might give this a shot.

from httpd24u.

Since CentOS 6 is no longer an issue and we aren't support CentOS 8 (yet/ever?), this should be relatively easy as I had the compile for CentOS 7 working before.

from httpd24u.

I was able to get it to build against openssl11 by removing openssl-devel, installing openssl11-devel, and updating the exported CPPFLAGS and LDFLAGS above the 'configure' line in the .spec file:

export LDFLAGS="-Wl,-z,relro,-z,now -L%{_libdir}/openssl11"
export CPPFLAGS="-I%{_includedir}/openssl11"

There has to be a cleaner way to exclude the base system openssl headers/libs from the build, though.

from httpd24u.