20

I wanted to upgrade OpenSSL to 1.0.1 on an Ubuntu 12.04 system. I have noticed that an apt-get upgrade openssl does not end up upgrading OpenSSL. Is the newer OpenSSL supported on Ubuntu?

I have also tried compiling from source. The compilation works but I cannot find out how to replace the built-in OpenSSL (1.0.0) with the newer one (1.0.1). Compiling from source gets me the newer version working along with the older version - I need to replace the older version with the newer version. My reason behind this need is to make FreeSWITCH compile with the newer version because the latest FreeSWITCH source is not compatible with OpenSSL 1.0.0 and there seems to be no make configuration in FreeSWITCH to point it towards the path for the new OpenSSL. (So it stubbornly keeps using the older version and failing to work!)

Thanks is advance. Any help would be greatly appreciated.

8
  • Please include in your question why do you want to upgrade. Ubuntu backports bugfixes including security fixes. Have a look at apt-get changelog openssl to see changes. It is by design Ubuntu does not upgrade packages within a release. This is how releasing in most non-Windows OSs work (freezing system libraries/packages versions).
    – gertvdijk
    Mar 4, 2014 at 15:30
  • I have included the reason - I need FreeSWITCH to work on the system which needs OpenSSL 1.0.1
    – KJ Saxena
    Mar 5, 2014 at 4:43
  • Try sudo apt-get install openssl.It would update your openssl package. Mar 7, 2014 at 8:52
  • You need to add another OpenSSL PPA to your sources list if you want rolling updates of the package. Yet, I'm not sure there's an Ubuntu PPA for this... Manual compiling would probably be the easiest. Mar 7, 2014 at 9:13
  • just update and upgrade sudo apt-get update && sudo apt-get upgrade Mar 8, 2014 at 14:27

3 Answers 3

12

NOTICE: this question and answer pre-date the OpenSSL bug, Heartbleed.

First you need to completely remove the old installation: (this will break most systems! Be careful! Most people will regret this) apt-get purge openssl

You may want to clean house by running:

apt-get autoremove && apt-get autoclean

Then you should download and compile the version you want (full list)

wget https://www.openssl.org/source/openssl-1.0.1g.tar.gz
8
  • 7
    For all of you reading this in the context of security updates: all local services are still linked against the Ubuntu provided OpenSSL. Please don't rely on a local OpenSSL install (in /usr/local by default)! So just update your Ubuntu system the regular way to receive security updates!
    – gertvdijk
    Apr 8, 2014 at 17:27
  • What kind of important DATA can be deleted ?
    – user267682
    Apr 11, 2014 at 2:19
  • I don't know, that wasn't my edit.
    – philshem
    Apr 11, 2014 at 6:45
  • Never thought, that 'clean house' mean removing all important packages and databases. Dunno how to restore my website now, lol.
    – Dracontis
    Apr 11, 2014 at 11:52
  • The current OpenSSL version on Ubuntu Trusty reports itself as being 1.0.1f. However, the OpenSSL team claims that g is the patched version: git.openssl.org/gitweb/…. I suggest installing from source...
    – Tom Swirly
    May 27, 2014 at 22:09
12

Install the development package!

1.0.1 is part of Ubuntu 12.04 at the time of writing. However, in order to compile against it, you also have to install the development package (libssl-dev)!

First do an update of the package listing

sudo apt-get update

Then install the development package and upgrade the library itself in one go:

sudo apt-get install openssl libssl-dev

You can see here 1.0.1 is part of 12.04: http://packages.ubuntu.com/precise-updates/openssl

In case your system still installs 1.0.0, you have some other repository set up or something else in your package management is changed to cause this error. In that case, inspect what is causing it to pin on 1.0.0 still by running

apt-cache policy openssl libssl-dev
4
  • Yes, it installs 1.0.1 but it is still affected. On 2 or my servers, both running 12.04, running the command above installs OpenSSL 1.0.1c which is vulnerable
    – user17934
    Apr 8, 2014 at 17:09
  • 4
    @DeanPerry No it's NOT vulnerable to Heartbleed since yesterday. Ubuntu backports fixes to the versions provided. Read the changelogs and the Ubuntu Security Advisory USN-2165-1. Just update your system and you're fine. Please don't spread fear by the first part of the version number and read up on how Ubuntu releasing works.
    – gertvdijk
    Apr 8, 2014 at 17:23
  • @gertvdijk Changelog you referenced is related to higher version (Quantal), but 12.04 (Precise) from original answer was updated as well, see.
    – mschayna
    Apr 10, 2014 at 8:49
  • @mschayna Changelog entry for precise then; here you go: launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.12
    – gertvdijk
    Apr 10, 2014 at 8:52
7
+25

Try downloading the latest version of libssl and openssl from http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/ and install both.

Warning: This will break automated security updates for OpenSSL.

1
  • I found updating to 1.0.1f of openssl and libssl was new enough to stop the routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version error that has popped up recently. May 1, 2018 at 7:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .