Red Hat Enterprise Linux 7.4 has just been released, and with it, a much-awaited (at least by me) update to OpenSSL, bringing it to version 1.0.2k.
openssl rebased to version 1.0.2k
The openssl package has been updated to upstream version 1.0.2k, which provides a number of enhancements, new features, and bug fixes, including:
-- Added support for the Datagram Transport Layer Security TLS (DTLS) protocol version 1.2.
-- Added support for the automatic elliptic curve selection for the ECDHE key exchange in TLS.
-- Added support for the Application-Layer Protocol Negotiation (ALPN).
-- Added Cryptographic Message Syntax (CMS) support for the following schemes: RSA-PSS, RSA-OAEP, ECDH, and X9.42 DH.Note that this version is compatible with the API and ABI in the OpenSSL library version in previous releases of Red Hat Enterprise Linux 7.
Security updates in RHEL 7.4
That bold text? That's the good part: added support for the Application-Layer Protocol Negotiation (ALPN).
You might remember that more than a year ago, Chrome disabled support for NPN and only allowed ALPN. As a direct result, HTTP/2 became impossible on RHEL or CentOS systems, because it didn't support ALPN. You could run Nginx in a Docker container to get a more up-to-date OpenSSL version, but for many, that's too hard or too much effort.
Now with this RHEL 7.4 update -- and the CentOS 7.4 release that'll be out in a few days -- you no longer need Docker and you can enable HTTP/2 in Nginx again for both Firefox & Chrome users.
server {
listen 443 ssl http2;
server_name your.fqdn.tld;
...
I'm very happy with this update as it -- finally -- brings a more recent OpenSSL version to RHEL & CentOS, removing the need for hacks/workarounds just for the sake of HTTP/2.
If you're a CentOS user, wait a couple of days for the packages to be built and update to CentOS 7.4. If your a RHEL user: go forth and upgrade to 7.4!
Update #1: requires Nginx package update, too
See update #2 below: packages are now available.
The good news: CentOS 7.4 is out and with it an updated OpenSSL package!
The 'bad' news: Nginx is compiled against OpenSSL 1.0.1, both from the Nginx RPMs as well as EPEL. So even if you update OpenSSL, it'll still point to an older OpenSSL release.
$ nginx -V nginx version: nginx/1.13.1 built by gcc 4.8.5 20150623 (Red Hat 4.8.5-4) (GCC) built with OpenSSL 1.0.1e-fips 11 Feb 2013 ...
Built with OpenSSL 1.0.1e.
Now we wait for an update from EPEL and the Nginx repo to compile Nginx against the latest OpenSSL release. Until then, HTTP/2 is still broken for ALPN in Chrome.
Update #2: updated Nginx packages are available
Good news! The nginx mainline repository has new packages built against the latest openssl. Update now to get all the HTTP/2 joy. ;-)
$ yum update nginx ... =============================================================================== Package Arch Version Repository Size =============================================================================== Updating: nginx x86_64 1:1.13.6-1.el7_4.ngx nginx-mainline 723 k Updating for dependencies: openssl x86_64 1:1.0.2k-8.el7 base 492 k openssl-devel x86_64 1:1.0.2k-8.el7 base 1.5 M openssl-libs x86_64 1:1.0.2k-8.el7 base 1.2 M Transaction Summary =============================================================================== Upgrade 1 Package (+3 Dependent packages)
Go HTTP/2!
Comments
Erorus Tuesday, August 1, 2017 at 23:21 -
“As a direct result, HTTP/2 became impossible on RHEL or CentOS systems, because it didn’t support ALPN. You could run Nginx in a Docker container to get a more up-to-date OpenSSL version, but for many, that’s too hard or too much effort.”
I still don’t know why you ignore this simple procedure:
1) download latest nginx source
2) download appropriate latest openssl source
3) run nginx’s configure, pointing at openssl source you just downloaded
4) make && make install
Far from “impossible.” If you want to add/remove specific nginx modules (e.g. brotli) you’ll want to get familiar with this pattern anyway.
$ nginx -V
nginx version: nginx/1.12.0
built by gcc 4.4.7 20120313 (Red Hat 4.4.7-18) (GCC)
built with OpenSSL 1.0.2k 26 Jan 2017
TLS SNI support enabled
configure arguments: –prefix=/etc/nginx –sbin-path=/usr/sbin/nginx –modules-path=/usr/lib64/nginx/modules –conf-path=/etc/nginx/nginx.conf –error-log-path=/var/log/nginx/error.log –http-log-path=/var/log/nginx/access.log –pid-path=/var/run/nginx.pid –lock-path=/var/run/nginx.lock –http-client-body-temp-path=/var/cache/nginx/client_temp –http-proxy-temp-path=/var/cache/nginx/proxy_temp –http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp –http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp –http-scgi-temp-path=/var/cache/nginx/scgi_temp –user=nginx –group=nginx –with-http_ssl_module –with-http_gunzip_module –with-http_gzip_static_module –with-threads –with-file-aio –with-http_v2_module –with-http_stub_status_module –with-cc-opt=’-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector –param=ssp-buffer-size=4 -m64 -mtune=generic’ –with-openssl=../openssl-1.0.2k –add-module=../ngx_brotli
svennd Thursday, August 3, 2017 at 09:57 -
And you redo that procedure for every update and patch released ? Most people like to use repo’s and focus on other tasks.
I’m very happy with this, as it looked like we where going to have to wait for http/2 until rhel 8 at some point.
John C. Wednesday, August 2, 2017 at 10:10 -
RHEL are deliberately weakening crypto to help our their NSA buddies. This is not the first time they’ve done something very suspect like this.
PaulB Thursday, September 14, 2017 at 11:42 -
Unfortunately, this is incorrect, You still have to compile nginx from source for HTTP2 or get it from a third party repo. The nginx version in epel is compiled against openssl 1.0.1.e
[root@c7-jump-box /etc]# nginx -V
nginx version: nginx/1.10.2
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-4) (GCC)
built with OpenSSL 1.0.1e-fips 11 Feb 2013
Despite openssl 1.02 being installed
[root@c7-jump-box /etc]# rpm -q openssl
openssl-1.0.2k-8.el7.x86_64
Before we get HTTP2 support back we need to wait for epel to offer an nginx version compiled against 1.02. The same applies to RH Software collections.
Chris Hills Friday, September 15, 2017 at 08:34 -
I have been using the brouken repo for nginx with http/2 in centos up to now. It has openssl statically linked in for alpn. I will probably switch back to the stock package now.
Keddy Saturday, September 16, 2017 at 01:20 -
Just updated to 7.4 and yea…. EPEL did not update nginx with OpenSSL 1.0.2. So no HTTP2 for you…
Mike Sunday, September 17, 2017 at 17:21 -
Q: “RedHat released yesterday (September 14) CentOS 7.4, which includes version 1.0.2 of OpenSSL.
Now all it takes is the Nginx RPM to be compiled with the latest version of OpenSSL to work with ALPN.”
A: “Next nginx release will have a rpm built specifically for CentOS/RHEL 7.4, but hopefully we’ll also provide current stable and mainline a bit sooner.”
https://forum.nginx.org/read.php?2,276398,276399