logo
Apache Lounge
Webmasters

 

About Forum Index Downloads Search Register Log in RSS X


Keep Server Online

If you find the Apache Lounge, the downloads and overall help useful, please express your satisfaction with a donation.

or

Bitcoin

A donation makes a contribution towards the costs, the time and effort that's going in this site and building.

Thank You! Steffen

Your donations will help to keep this site alive and well, and continuing building binaries. Apache Lounge is not sponsored.
Post new topic   Forum Index -> Apache View previous topic :: View next topic
Reply to topic   Topic: Apache 2.4.12 build with OpenSSL 1.0.2
Author
mlp



Joined: 06 Jun 2014
Posts: 4
PostPosted: Wed 11 Feb '15 14:44    Post subject: Apache 2.4.12 build with OpenSSL 1.0.2 Reply with quote
Hello,

do you have plans for building Apache 2.4 with OpenSSL 1.0.2?

One good reason for upgrading Apache to OpenSSL to 1.0.2 would be the ability to disable TLS session tickets, eq. when using PFS:

Code:
SSLOpenSSLConfCmd Options -SessionTicket


Here are a few references:

http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslopensslconfcmd
https://timtaubert.de/blog/2014/11/the-sad-state-of-server-side-tls-session-resumption-implementations/

I tried to experiment with replacing OpenSSL dlls and exe in apache\bin directory but that did not work, because it looks like SSLOpenSSLConfCmd configuration directive is only available when Apache is compiled against OpenSSL 1.0.2.
Back to top
admin
Site Admin


Joined: 15 Oct 2005
Posts: 692
PostPosted: Wed 11 Feb '15 14:57    Post subject: Reply with quote
See note at www.apachelounge.com/viewtopic.php?p=29598#29598
Back to top
glsmith
Moderator


Joined: 16 Oct 2007
Posts: 2268
Location: Sun Diego, USA
PostPosted: Thu 12 Feb '15 10:48    Post subject: Reply with quote
Beginning with Apache 2.4.11 you can turn off SSL session tickets. This does not require OpenSSL 1.0.2, the minimum OpenSSL version is 0.9.8f. It was added to Apache due to if you do not restart Apache on a regular basis (like daily) you compromise perfect forward secrecy.

http://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslsessiontickets
Back to top
mlp



Joined: 06 Jun 2014
Posts: 4
PostPosted: Fri 13 Feb '15 8:50    Post subject: Reply with quote
Thanks for the tip!
Back to top


Reply to topic   Topic: Apache 2.4.12 build with OpenSSL 1.0.2 View previous topic :: View next topic
Post new topic   Forum Index -> Apache