Apache :: How Do I Upgrade Apache With OpenSSL & PHP?

joez430

Ok, here it goes. I downloaded the latest install Apache has from their site which was bundled with Open SSL. Here are the exact versions

I'm running this setup on a Windows 2008 Server 64 bit

Apache 2.2.22
Mod_ssl/2.2.22 OpenSSL/0.9.8t
PHP/5.3.6

I installed a shopping cart that's getting scanned by security metrics and they want me to update OpenSSL to the newest version.

I looked at the downloads here and downloaded the latest release. It has the same folder structure as my apache install now I just don't know how to setup the service and get it running with the Apache service monitor.

Can somebody point me in the right direction? I have searched through threads, tested on my local server and did a lot of google searching but still can't seem to find an answer how to seamlessly upgrade all this stuff to the newest versions due to security concerns.

Sorry if this seems like a simple questions. And thank you in advance.

glsmith

Depending on the version you downloaded here, you need to download and install the proper VC++ (Visual C++) Redistributable. If I remember correctly, PHP 5.3.6 was the first version only to come in VC9, so if you get a VC9 version of Apache here, you probably already have the needed redistributable installed.

If your Apache service is showing in your ApacheMonitor's window, just Stop the service. In any case, just make sure Apache is not running.

Backup the Apache you have now! If something doesn't work out for whatever reason, you can restore it back to what it is now easily.

Upgrade:

The only binary files are located in Apache's bin, lib and modules folders, only bin and modules folders need to be changed. So just copy the files in the bin and modules folders from here to overwrite the ones you have now.

The lib and include folders should be replaced as well if you even have an inkling that you may try to compile a third party module some day, so it's not a bad idea to just do it anyway.

Once that is done, try starting up the Apache service.

If the service is not showing in ApacheMonitor, from a command prompt "Run as Administrator", CD to Apache's bin folder and type;

httpd -k install
httpd -k start

Apache should now be running and show in the ApacheMonitor window.

joez430

Thank you for the reply. I have done what was suggested. I looked at my installs and saw a few different redistributable packages installed on this machine.

I copied the bin and modules folder completely and just overwrote what was in there. When I try to start the apache service now I get the requested operation has failed.

If I try to install the service from the bin folder I get service already installed. When I try to start the service from the cmd prompt I get the following error.

C:\Apache2.2\bin>httpd - starts

httpd: Syntax error on line 60 of the C:/Apache2.2/conf/httpd.conf: Cannot loac C:/Apache2.2/modules/mod_actions.so into Server: The specified procedure could not be found.

Have you seen this before? Thanks for the help!

glsmith

Which Apache did you install from here?

joez430

I downloaded

Apache 2.4.2 IPv6 and Crypto enabled

Build with apr-1.4.6 apr-util-1.4.1 apr-iconv-1.2.1

openssl-1.0.1c zlib-1.2.7 pcre-8.30 libxml2-2.7.8 lua-5.1.5 expat-2.1.0
httpd-2.4.2-win32.zip info 13 May '12 10.179K

Thanks!

glsmith

ok, that's a vc10 build and I'm thinking you do not have a vc10 redistributable installed, that would make the most sense on that error, not that it's actually the cause.

Also, there's differences in 2.4.2 when it comes to modules and configuration, so that's a major upgrade, not a minor one you had originally requested.

Get 2.2.22, when copying the modules, just delete your modules folder now since you have a lot of modules in there not in 2.2. If you have any third party ones, you may have to find new versions of those as well (VC9 or VC10).

http://www.apachelounge.com/download/win32/bins/httpd-2.2.22-win32.zip

in the readme, there's a link to the redistributable needed, download and install it too.

joez430

Thanks! I got it to work using your instructions. The only thing I've noticed in the Apache service monitor is the same versions of the Mod SSL and OpenSSL.

I hope I was asking the questions right. I'm sorry if my questions may have been misleading. Now in my apache service monitor it still says

Apache/2.2.22 (win32) mod_ssl/2.2.22 OpenSSL/0.9.8t PHP/5.3.5

How do I upgrade the SSL? I thought by upgrading the Apache it would have a new module? When I initially downloaded Apache it came bundled with SSL already.

Thanks so much

glsmith

The SSL is upgraded. When the service was first installed, it set the description string to what it was at the time. If you want to make sure, at a command prompt type

httpd -V

it will shows you that and other information.

If you uninstall then reinstall the service, the ApacheMonitor will show the right versions, but why bother.

joez430