Topic: Apache 2.4.26-Dev available with Openssl 1.1.0e VC14

[Steffen]

With Apr and Apr-util 1.6 around the corner it is a good moment to make it available. And quite some people are waiting for OpenSSL 1.1.x

Apachelounge is running it now, and chrome is now picking strong cipher CHACHA20_POLY1305.

Using the recommended at https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28default.29

Download removed, we are now doing VC15

Changes over current 2.4.25:
apr 1.6.1-dev
apr-util 1.6.1-dev
openssl 1.1.0e
nghttp2 1.21.1
mod_http2 1.10.1
Datailed httpd, apr and apr-util changelog is in the .zip.

Please report how it goes !

[o6asan]

Hi Steffen!

Thanks for the new version.

Now I run my server by Apache 2.4.26-Dev.
I have WordPress site on the server and no problem at this point.

Google Chrome gives this after updating.

My server environment:
Windows7 HP SP1 32-bit
Apache 2.4.26-Dev
MariaDB 10.1.22
PHP 7.1.4
ActivePerl 5.24.1

[glsmith]

There are times like this when I wish I had Linux to see if things work in it.

For me, abs doesn't work w/ openssl 1.1.0. It just sits there and does nothing till you ctrl+c. Is it just me?

[o6asan]

[glsmith]

Anyone else having a problem loading mod_security that loads fine in 2.4.25?

[Steffen]

mod_security from here runs fine:


Apache/2.4.26-dev (Win32) mod_view/2.2 mod_watch/4.3P OpenSSL/1.1.0e mod_fcgid/2.3.9 mod_jk/1.2.41 mod_bmx/0.9.6

[Fri Apr 21 11:09:20.000252 2017] [:notice] [pid 1408:tid 684] ModSecurity for Apache/2.9.1 (http://www.modsecurity.org/) configured.
[Fri Apr 21 11:09:20.000252 2017] [:notice] [pid 1408:tid 684] ModSecurity: APR compiled version="1.5.2"; loaded version="1.6.1-dev"

[DnvrSysEngr]

Running Mod_Security 2.9.1 smoothly after going from 2.4.25 to 2.4.26-Dev

Wed Apr 19 15:15:19.006271 2017] [:notice] [pid 6264:tid 384] ModSecurity for Apache/2.9.1 (http://www.modsecurity.org/) configured.
[Wed Apr 19 15:15:19.006271 2017] [:notice] [pid 6264:tid 384] ModSecurity: APR compiled version="1.5.2"; loaded version="1.6.1-dev"
[Wed Apr 19 15:15:19.006271 2017] [:warn] [pid 6264:tid 384] ModSecurity: Loaded APR do not match with compiled!
[Wed Apr 19 15:15:19.006271 2017] [:notice] [pid 6264:tid 384] ModSecurity: PCRE compiled version="8.38 "; loaded version="8.40 2017-01-11"
[Wed Apr 19 15:15:19.006271 2017] [:warn] [pid 6264:tid 384] ModSecurity: Loaded PCRE do not match with compiled!
[Wed Apr 19 15:15:19.006271 2017] [:notice] [pid 6264:tid 384] ModSecurity: LUA compiled version="Lua 5.1"
[Wed Apr 19 15:15:19.006271 2017] [:notice] [pid 6264:tid 384] ModSecurity: YAJL compiled version="2.1.0"
[Wed Apr 19 15:15:19.006271 2017] [:notice] [pid 6264:tid 384] ModSecurity: LIBXML compiled version="2.9.3"
[Wed Apr 19 15:15:19.006271 2017] [:notice] [pid 6264:tid 384] ModSecurity: StatusEngine call: "2.9.1,Apache/2.4.26-dev (Win64),1.5.2/1.6.1-dev,8.38/8.40 2017-01-11,Lua 5.1,2.9.3,3be1df5ed78ef99ebe73e839ffe190504cd5b820"
[Wed Apr 19 15:15:20.379074 2017] [:notice] [pid 6264:tid 384] ModSecurity: StatusEngine call successfully sent. For more information visit: http://status.modsecurity.org/

[glsmith]

It's my mod_security. AL's module with my dlls works. I even did a fresh build of mod_security but no dice. Strange that it shows up now and I haven't got a clue where to begin to figure out why.

[Steffen]

Made now as a VC15 build available. See the notes on the VC15 download page.

mod_http2 is now again 1.0.1, coming days it is upgraded to 1.0.3.

We are going only ship OpenSSL 1.1 with VC15.

VC15 is backward compatible with VC14, so VC14 users can upgrade to VC15.

See also https://www.apachelounge.com/viewtopic.php?p=35228

[admin]

Yes.

[Izomye]

Now I have installed the dev build on my server.

At this moment is php over fastcgi very faster and mod_secuirty is smoother

Ant the best:

TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8) ECDH x25519 (eq. 3072 bits RSA) FS 256

Nice work.