Re: Updating an httpd server on Amazon Linux 2 for TLSv1.3?

--00000000000078e8d8064d2acfc6
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Mon, Mar 16, 2026 at 5:10=E2=80=AFPM James H. H. Lampert via users <
[email protected]> wrote:

> I've got an Apache httpd server running on Amazon Linux 2. I've just
> updated it to 2.4.66.
>
> An SSLLabs scan tells me I don't have TLSv1.3 enabled. And a Google
> search told me to add "+TLSv1.3" to the SSLProtocol line in ssl.conf.
>
> When I tried that, the server crashed on takeoff. The same Google result
> said I needed openssl 1.1.1 or later. When I did "openssl version," I
> got "OpenSSL 1.0.2k-fips  26 Jan 2017," and after I did a yum update
> openssl, I still got "OpenSSL 1.0.2k-fips  26 Jan 2017."
>
> Amazon tells me that if I want openssl 1.1, I need to install it
> separately. And when I did a Google search on how to switch httpd over
> to a separately installed openssl 1.1, everything I got said "compile
> from source."
>
> How on Earth would I do that, without having any development tools on
> the instance?
>
> Can somebody point me to a path-of-least-resistance?
>
> --
> James H. H. Lampert
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
>
>
Installing openssl 1.1 and rebuilding httpd is likely the sanest approach
here.

--00000000000078e8d8064d2acfc6
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><br></div><br><div class=3D"gmail_quote g=
mail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Mon, Mar 16,=
 2026 at 5:10=E2=80=AFPM James H. H. Lampert via users &lt;<a href=3D"mailt=
o:[email protected]">[email protected]</a>&gt; wrote:<br></div><b=
lockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-le=
ft:1px solid rgb(204,204,204);padding-left:1ex">I&#39;ve got an Apache http=
d server running on Amazon Linux 2. I&#39;ve just <br>
updated it to 2.4.66.<br>
<br>
An SSLLabs scan tells me I don&#39;t have TLSv1.3 enabled. And a Google <br=
>
search told me to add &quot;+TLSv1.3&quot; to the SSLProtocol line in ssl.c=
onf.<br>
<br>
When I tried that, the server crashed on takeoff. The same Google result <b=
r>
said I needed openssl 1.1.1 or later. When I did &quot;openssl version,&quo=
t; I <br>
got &quot;OpenSSL 1.0.2k-fips=C2=A0 26 Jan 2017,&quot; and after I did a yu=
m update <br>
openssl, I still got &quot;OpenSSL 1.0.2k-fips=C2=A0 26 Jan 2017.&quot;<br>
<br>
Amazon tells me that if I want openssl 1.1, I need to install it <br>
separately. And when I did a Google search on how to switch httpd over <br>
to a separately installed openssl 1.1, everything I got said &quot;compile =
<br>
from source.&quot;<br>
<br>
How on Earth would I do that, without having any development tools on <br>
the instance?<br>
<br>
Can somebody point me to a path-of-least-resistance?<br>
<br>
--<br>
James H. H. Lampert<br>
<br>
---------------------------------------------------------------------<br>
To unsubscribe, e-mail: <a href=3D"mailto:[email protected]=
g" target=3D"_blank">[email protected]</a><br>
For additional commands, e-mail: <a href=3D"mailto:[email protected].=
org" target=3D"_blank">[email protected]</a><br>
<br></blockquote><div><br></div><div>Installing openssl 1.1 and rebuilding =
httpd is likely the sanest approach here.=C2=A0</div></div></div>

--00000000000078e8d8064d2acfc6--