Month: March 2023

Migration to OpenSSL+QUIC / quictls 3.0

As soon as OpenSSL 1.1.1 is approaching to its EOL, the decision is to migrate to 3.0. We already provided openssl 3.0.8 builds for AARCH64. All the nginx and apache builds use it as a dependency. Now we are building 3.0.8 for x86_64. Please note that as of 28.03.2023 nginx and apache are not yet rebuilded and still use 1.1.1 as a dependency, thus dnf upgrade may fail until everything will be rebuilded againgst 3.0.8. This is an expected behavior.

NGINX 1.23.4 will be the first build with OpenSSL 3.0.

Please consider supporting my work.

 

UPDATE. Builds and migration is finished, please report any problems.

Apache httpd 2.4.56 with brotli support, TLS 1.3 final (RFC 8446) built against OpenSSL 1.1.1t with http2, mod_http2 2.0.13 and ALPN for Red Hat Enterprise Linux 7/8/9 and CentOS 7, Alma Linux 8/9, Rocky Linux 8/9

Apache httpd 2.4.56-1 with brotli compression library from Google, TLS 1.3 Final (RFC 8446), http2 (HTTP/2) support for Red Hat Enterprise Linux and CentOS 7/8, Alma Linux 8, Rocky Linux 8 added to repository. mod_http2 2.0.13 is built dynamically against OpenSSL 1.1.1t.

Fixed vulnerabilities:

  • CVE-2023-27522: HTTP response smuggling bug
  • CVE-2023-25690: HTTP request smuggling vulnerability

We build OpenSSL+QUIC 1.1.1 separately since v2.4.53-2, installing it separately to /lib64 with .so.81.1.1 suffix to ensure it won’t interfere with your system libraries. You can safely delete openssl111* packages.

On EL8 and EL9 please enable httpd module:

dnf module enable httpd:codeit

Since 2.4.33 we added brotli compression library. Since 2.4.35 release we start building Apache httpd against OpenSSL 1.1.1*. Since 2.4.37 release TLS 1.3 final version (not to be confused with any draft versions) is supported and enabled by default. Please note that TLS 1.3 final version is supported in Chrome 70+ and Mozilla Firefox 63+. brotli support is already included in base RPM file. All you need is to add filters like <pre>AddOutputFilterByType BROTLI_COMPRESS text/html text/plain text/xml text/css text/javascript application/javascript</pre>