Apache httpd 2.4.41 with brotli compression library from Google, TLS 1.3 Final (RFC 8446), http2 (HTTP/2) support for Red Hat Enterprise Linux and CentOS added to repository. Mod_ssl is built statically against OpenSSL 1.1.1c.
Links:
Since 2.4.33 we added brotli compression library. Since 2.4.35 release we start building Apache httpd against OpenSSL 1.1.1*. Since 2.4.37 release TLS 1.3 final version (not to be confused with any draft versions) is supported and enabled by default.
Please note that TLS 1.3 final version is supported in Chrome 70+ and Mozilla Firefox 63+.
brotli support is already included in base RPM file. All you need is to add filters like
AddOutputFilterByType BROTLI_COMPRESS text/html text/plain text/xml text/css text/javascript application/javascript
Http2 Apache httpd module no longer supports prefork mpm from version 2.4.27. If you need http2 module, please disable prefork mpm and enable evemt mpm in /etc/httpd/conf.modules.d/00-mpm.conf. We already made this in 00-mpm.conf in our packages. If you are updating other vendor installation, please update this file.
For correct work with SELinux please update the following boolean:
setsebool -P httpd_execmem=1
Feel free to use our CentOS/RHEL repository. Please also note that this package depends on apr-util 1.5.0+ and libnghttp, which you can found in EPEL repository. So, the easiest way to use our builds of Apache HTTPd is to add EPEL repository, if you still do not have it: yum install -y epel-release
Changes with Apache 2.4.41:
*) mod_proxy_balancer: Improve balancer-manager protection against
XSS/XSRF attacks from trusted users. [Joe Orton,
Niels Heinen ]
*) mod_session: Introduce SessionExpiryUpdateInterval which allows to
configure the session/cookie expiry's update interval. PR 57300.
[Paul Spangler ]
*) modules/filters: Fix broken compilation when using old GCC (<4.2.x).
PR 63633. [Rainer Jung, Joe Orton]
*) mod_ssl: Fix startup failure in 2.4.40 with SSLCertificateChainFile
configured for a domain managed by mod_md. [Stefan Eissing]
Changes with Apache 2.4.40
*) core, mod_rewrite: Set PCRE_DOTALL by default. Revert via
RegexDefaultOptions -DOTALL [Yann Ylavic]
*) core: Remove request details from built-in error documents [Eric Covener]
*) mod_http2: core setting "LimitRequestFieldSize" is not additionally checked on
merged header fields, just as HTTP/1.1 does. [Stefan Eissing, Michael Kaufmann]
*) mod_http2: fixed a bug that prevented proper stream cleanup when connection
throttling was in place. Stream resets by clients on streams initiated by them
are counted as possible trigger for throttling. [Stefan Eissing]
*) mod_http2/mpm_event: Fixes the behaviour when a HTTP/2 connection has nothing
more to write with streams ongoing (flow control block). The timeout waiting
for the client to send WINODW_UPDATE was incorrectly KeepAliveTimeout and not
Timeout as it should be. Fixes PR 63534. [Yann Ylavic, Stefan Eissing]
*) mod_proxy_balancer: Load balancer required byrequests when bytraffic chosen.
PR 62372. [Jim Jagielski]
*) mod_proxy_hcheck: Create the configuration for mod_proxy_hcheck
when used in BalancerMember. PR 60757. [Jean-Frederic Clere]
*) mod_proxy_hcheck: Mute extremely frequent debug message. [Yann Ylavic]
*) mod_ssl/mod_md: reversing dependency by letting mod_ssl offer hooks for
adding certificates and keys to a virtual host. An additional hook allows
answering special TLS connections as used in ACME challenges.
Adding 2 new hooks for init/get of OCSP stapling status information when
other modules want to provide those. Falls back to own implementation with
same behaviour as before.
[Stefan Eissing]
*) mod_md: new features
- protocol
- supports the ACMEv2 protocol. It is the default and will be used on the next
certificate renewal, unless another "MDCertificateAuthority" is configured
- ACMEv2 endpoints use the GET via empty POST way of accessing resources, see
announcement by Let's Encrypt:
https://community.letsencrypt.org/t/acme-v2-scheduled-deprecation-of-unauthenticated-resource-gets/74380
- challenges
- new challenge method 'tls-alpn-01' implemented
- challenge type 'tls-sni-01' has been removed as CAs do not offer this any longer
- supports command configuration to setup/teardown 'dns-01' challenges
- supports wildcard certificates when dns challenges are configured
- status information and monitoring
- a domain exposes its status at https:///.httpd/certificate-status
- Managed Domains are now in Apache's 'server-status' page
- A new handler 'md-status' exposes verbose status information in JSON format
- new directives
- "MDCertificateFile" and "MDCertificateKeyFile" to configure a
Managed Domain that uses static files. Auto-renewal is turned off for those.
- "MDMessageCmd" that is invoked on several events: 'renewed', 'expiring' and
'errored'.
- "MDWarnWindow" directive to configure when expiration warnings shall be issued.
[Stefan Eissing]
*) mod_mime_magic: Fix possible corruption of returned strings.
[Christophe Jaillet]
*) Default "conf/magic": Fix pattern for "audio/x-wav" for WAV files,
remove "audio/unknown" pattern for other RIFF files.
[ГЂngel OllГ© BlГЎzquez ]
*) mod_proxy_http2: fixing a potential NULL pointer use in logging.
[Christophe Jaillet, Dr Silvio Cesare InfoSect]
*) mod_dav: Reduce the amount of memory needed when doing PROPFIND's on large
collections by improving the memory management. [Joe Orton, Ruediger Pluem]
*) mod_proxy_http2: adding support for handling trailers in both directions.
PR 63502. [Stefan Eissing]
*) mod_proxy_http: forward 100-continue, and minimize race conditions when
reusing backend connections. PR 60330. [Yann Ylavic, Jean-Frederic Clere]
*) mod_proxy_balancer: Fix some HTML syntax issues. [Christophe Jaillet]
*) When using mod_status with the Event MPM, report the number of requests
associated with an active connection in the "ACC" field. Previously
zero was always reported with this MPM. PR60647. [Eric Covener]
*) mod_http2: remove the no longer existing h2_ngn_shed.c from Cmake.
[Stefan Eissing]
*) mod_proxy/ssl: Proxy SSL client certificate configuration and other proxy
SSL configurations broken inside context. PR 63430.
[Ruediger Pluem, Yann Ylavic]
*) mod_proxy: allow SSLProxyCheckPeer* usage for all proxy modules.
PR 61857. [Markus Gausling , Yann Ylavic]
*) mod_reqtimeout: Fix default rates missing (not applied) in 2.4.39.
PR 63325. [Yann Ylavic]
*) mod_info: Fix output of server settings for PIPE_BUF in mod_info in
the rare case that PIPE_BUF is defined. [Rainer Jung]
*) mod_md: Store permissions are enforced on file creation, enforcing restrictions in
spite of umask. Fixes . [Stefan Eissing]
Hi Alex,
Openssl just released 1.1.1d. Do you think you have any chance to have 1 new build soon?
Hi Jeffrey,
Already updated 🙂
Thanks.
Hi Alex,
Wow. Thanks.
Support for CENTOS 7.7 ( python 3 and deprecated stuf) ?
https://www.mail-archive.com/[email protected]/msg11396.html
CENTOS 8 24-09-2019 ?
https://wiki.centos.org/About/Building_8
Thanks only asking to be sure. 😉
Yes, we support CentOS 7.7 and I think our builds work fine with 7.7.
CentOS 8.0: good question, let’s see later. I think all patches we apply now can be included in 8.0.
Dear Alexander
It would be great to have Apache httpd 2.4.41 with brotli support on CentOS 8. There is no repository for it at your servers and of course it doesn’t work on CentOS8 😉
Any release information about CentOS 8 repository?
Thank you in advance for your help and time.
Sincerely
Dear Mateusz,
I checked and see that CentOS 8 already has Apache httpd 2.4.37 with big count of patches. mod_brotli and mod_http2 are included, OpenSSL 1.1.1 is now part of system in CentOS/RHEL 8.
What exactly do you expect from CodeIT builds in this case?
Dear Alexander
Yes, you are absolutely right. I was thinking about further major versions of Apache, which I suppose CentOS 8 default repository will not support beyond 2.4.37.
Sincerely
The version httpd 2.4.41 stopped my certbot, why? How could I do a downgrade or fix it?
There is a discussion about this problem at https://community.letsencrypt.org/t/the-apache-plugin-is-not-working/102520
Thanks, Pascal, I now understand what is the specific problem users address.
We use Fedora apachectl file that works with systemd, so we really do not support all the features vanilla builds provide.
I now see that the problem first appeared in 2.4.41-3 build, 2.4.41-2 still supports apachectl -t -D DUMP_RUN_CFG.
2.4.41-3 is a refresh of Fedora spec and patches, we will try to dig why apachectl behavior changed with updated spec.
Thank you for the link.
This specific issue is fixed by removing new Fedora apachectl.sh file.
Released as httpd-2.4.41-4.
Hello! I see that the latest package also installs nginx – is libbrotli part of that now? It seemed to update libbrotli to nginx + a separate brotli package.
Thanks!
Hi Reio,
We see that brotli libraries are now present in EPEL repository, package name is “brotli”. To avoid problems with same files and different versions, we decided to use brotli libraries from EPEL repository. Please ensure you added it as it is described in repo configuration page.
No, httpd should not require nginx, it should install brotli package from EPEL instead.
Thanks, I just removed nginx. I noticed earlier already, that brotli 1.0.7 was now taken from epel. But updating httpd to 2.4.41-4 seemingly replaced libbrotli 1.0.6 with nginx. Unfortunately I didn’t save the yum output.
When I do an update on my machine, it suggests to replace “libbrotli.x86_64 1:1.0.6-1.codeit.el7” with “nginx 1:1.16.1-1.el7.codeit”, and it also wants to install brotli from epel for dependencies.
Solution is to “manually” replace brotli with libbrotli :
# yum shell
> remove libbrotli
> install brotli
> transaction solve
> transaction run
> exit
Doing that you will avoid having to install nginx to remove it afterwards.
Hello,
thanks for your efforts. So, once installed the newer httpd version on CentOS 7, is
LoadModule http2_module modules/mod_http2.so
needed to be added on conf.modules.d/00-base.conf and it works as expected?
Is it correct?
And, for example, do you know Virtualmin and possible issues about it?
thanks
pardon, and also, please: when upgraded, are the old .conf files untouched? That is, does it create the rpmnew files as usual or does it overwrite anything and so, better to do a previous backup of the conf files? Thanks
Hello, could you build –with-suexec-docroot /home or please explain how to easily change suexec dir to /home without rebuild… many thanks
No, we won’t do that. Please make your own builds.
This depends on your system: usually yum does not overwrite files with changes and creates rpmnew. Just test on virtual machine that has close configuration as your server.
And yes of course please do backups to rollback fast.
We already include 10-h2.conf that has
LoadModule http2_module modules/mod_http2.so
in it.
Hello, I’m trying to rebuild your src rpm because I need the
%define suexec_docroot /home
and Epoch :1 and 1: in some Requires…
then, when I (eg.)
rpmbuild -ba /root/rpmbuild/SPECS/httpd.spec.41-4
at first it complains about the installed openssl-devel which conflicts.
Do I need to uninstall openssl on my machine or why don’t you explain what are the issues with openssl?
Then, you wrote into the specs
–with-ssl=/root/openssl-1.1.1d
why it expects openssl-1.1.1d into the root?
Maybe that means when you build that rpm, you had the openssl-1.1.1d into /root ?
If I try to get the latest openssl source into /root/openssl-1.1.1d
the compiler continues but then
/root/openssl-1.1.1d/include/openssl/rsa.h:13:34: fatal error: openssl/opensslconf.h: No such file or directory
maybe because that should be compiled for CentOS 7 before…
So, please, how to correctly build your rpm with my patch without errors about openssl?
The problem is: I need to update the Apache 2.4.6 to 2.4.41 on CentOS 7, I don’t need to install it from scratch…this is the main issue. Please help about this, many thanks
Update:
to try, I can’t even remove openssl from my system because it would remove many dependencies which I can’t remove under any circumstances. And also, at the moment the update to CentOS 8 is still impossible because data to restore would mean too many hours of work. At the moment, the only thing I need is support for the http2 protocol and so it’s getting more complicated than expected.
Frank, sorry, we really have not enough budget and effort to support rpm building questions.
Everything here (RPMs and SRPMs) is provided as is.
I would suggest you to ask for support on serverfault/stackoverflow.
Hi Alexander,
Would you be looking at including the mod_MD module in a future release by any chance?
many thanks
Ade
Hi Adrian,
It requires more dependencies (and newer versions that we don’t have in CentOS).
This will have conflicts at least with curl.
So short answer is no, please migrate to EL8 for this.
#cat /etc/yum.repos.d/codeit.el7.repo
[CodeIT]
name=CodeIT repo
baseurl=https://repo.codeit.guru/packages/centos/7/$basearch
enabled=1
gpgkey=https://repo.codeit.guru/RPM-GPG-KEY-codeit
gpgcheck=1
#yum update httpd*
…
Dependencies Resolved
=============================================================================
Package Arch Version Repository Size
=============================================================================
Updating:
apr x86_64 1.5.2-1.el7.codeit CodeIT 111 k
httpd x86_64 2.4.41-4.codeit.el7 CodeIT 1.4 M
httpd-tools x86_64 2.4.41-4.codeit.el7 CodeIT 1.3 M
Installing for dependencies:
httpd-filesystem noarch 2.4.41-4.codeit.el7 CodeIT 27 k
libnghttp2 x86_64 1.31.1-2.el7 epel 67 k
mod_http2 x86_64 1.15.3-1.codeit CodeIT 208 k
Transaction Summary
=============================================================================
Install ( 3 Dependent packages)
Upgrade 3 Packages
Total download size: 3.0 M
# rpm -qa | grep httpd
httpd-tools-2.4.6-90.el7.centos.x86_64
httpd-2.4.6-90.el7.centos.x86_64
httpd-itk-2.4.7.04-2.el7.x86_64
Соотвественно:
…
AssignUserId p603 p603-www
…
и
LoadModule mpm_itk_module modules/mod_mpm_itk.so
После yum update
Апач не стартует.
В логах:
[Wed Feb 05 13:10:21.337262 2020] [suexec:notice] [pid 1203:tid 140542650091712] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Wed Feb 05 13:10:21.337376 2020] [mpm_itk:crit] [pid 1203:tid 140542650091712] mpm-itk cannot use threaded MPMs; please use prefork.
Помогло откатить пакеты httpd на те которые не из вашего репозитория.
Я так понимаю что httpd-itk-2.4.7.04-2.el7.x86_64 с httpd-2.4.41-4.codeit.el7.x86_64.rpm не работает.
У вас в репозитории httpd-itk нет.
Добрый день, Ярослав.
Да, именно так, для вас новости плохие.
Мы не поддерживаем mpm itk, а только делаем аналог «родного» httpd с патчами Redhat/Fedora для CentOS 6/7.
Но всё же попробуйте поменять mpm на prefork в своём конфиге. Мы не тестировали это никогда.
как временное решение:
# cat codeit.el7.repo
[CodeIT]
name=CodeIT repo
baseurl=https://repo.codeit.guru/packages/centos/7/$basearch
enabled=1
gpgkey=https://repo.codeit.guru/RPM-GPG-KEY-codeit
gpgcheck=1
exclude=httpd*
https://github.com/openssl/openssl/commit/419102400a2811582a7a3d4a4e317d72e5ce0a8f
Is the above commit applied to the version of OpenSSL (1.1.1d) prior to compiling apache httpd 2.4.41-4?
Albert, we are not experts on OpenSSL development. But as soon as commit was made on 4 Dec 2019, and latest OpenSSL 1.1.1d was released in September 2019, I think that we still not have this fix in our builds.
You have to wait for next OpenSSL release (e.g. 1.1.1e) and of course we will make a new build (e.g. httpd-2.4.41-5) against OpenSSL 1.1.1e.
Hello and thanks for this package. I’ve installed it on a CentOS 7.7 server, configured with the Protocols directive and all the stuff. But it keeps saying that ALPN is not enabled. I am missing something? Thanks.
Hi Val,
Please check the default setup from our package, it should work by default.
I think you may have have mod_http2 disabled.
Thanks for getting back so quickly. httpd -M shows http2_module (shared). When checking with:
curl -I -v –http2 https://into-cloud.it
I can see Upgrade: h2,h2c in the headers. But ALPN seems not to work:
ALPN, server did not agree to a protocol
What else can I check?
Solved. I needed to update mod_ssl too. Thanks again for this package!