openssl 버전 업그레이드 (테스트)

• openssl 버전이 낮아서 인증서 검증에 실패하거나 보안 이슈가 발생할 수 있기에 업그레이드 필요

1. 기존 Openssl 삭제

• 아래의 명령어를 입력하여 기존 Openssl를 삭제

  $ yum remove openssl -y
  Loaded plugins: fastestmirror
  Resolving Dependencies
  ...중략...
  Complete!

  
  

2. Openssl 1.1.1o 다운로드

• 아래의 명령어를 입력하여 Openssl 1.1.1o를 다운로드

  $ wget --no-check-certificate https://www.openssl.org/source/openssl-1.1.1o.tar.gz
  --2022-06-28 10:24:33--  https://www.openssl.org/source/openssl-1.1.1o.tar.gz
  Resolving www.openssl.org (www.openssl.org)... 23.65.57.54, 2600:1410:2000:19a::c1e, 2600:1410:2000:19c::c1e
  Connecting to www.openssl.org (www.openssl.org)|23.65.57.54|:443... connected.
  WARNING: cannot verify www.openssl.org's certificate, issued by ‘/C=US/O=Let's Encrypt/CN=R3’:
  Issued certificate has expired.
  HTTP request sent, awaiting response... 200 OK
  Length: 9856386 (9.4M) [application/x-gzip]
  Saving to: ‘openssl-1.1.1o.tar.gz’
  ...중략...
  2022-06-28 10:24:36 (97.8 MB/s) - ‘openssl-1.1.1o.tar.gz’ saved [9856386/9856386]
  
  $ ls -al openssl-1.1.1o.tar.gz
  -rw-r--r--. 1 root root 9856386 May  3 23:02 openssl-1.1.1o.tar.gz

  
  

3. Openssl 1.1.1o 압축해제

• 아래의 명령어를 입력하여 다운받은 Openssl 1.1.1o를 압축 해제

  $ tar -xvfz openssl-1.1.1o.tar.gz

  
  

4. Openssl 1.1.1o 폴더로 이동 및 설정

• 아래의 명령어처럼 입력

  $ cd openssl-1.1.1o
  $ ./config shared zlib
  Configuring OpenSSL version 1.1.1o (0x101010ffL) for linux-x86_64
  Using os-specific seed configuration
  Creating configdata.pm
  Creating Makefile

  
  

5. Openssl 1.1.1o 설치

• 아래의 명령어를 입력하여 Openssl 1.1.1o를 설치

• 설치에 필요한 패키지 설치

  $ yum install gcc gcc-c++ pcre-devel zlib-devel perl wget -y

• Openssl 1.1.1o를 컴파일

  $ make && make install

  
  

6. Openssl 1.1.1o 정상 동작 확인

• 아래의 명령어를 입력하여 /usr/local/bin/openssl 경로에 설치한 Openssl 1.1.1o가 정상동작하는지 확인 가능

  $ cp /usr/local/bin/openssl /usr/bin/openssl
  
  $ /usr/local/bin/openssl version
  /bin/openssl: error while loading shared libraries: libssl.so.1.1: cannot open shared object file: No such file or directory

• openssl: error while loading shared libraries: libssl.so.1.1: cannot open shared object file: No such file or directory 에러 발생

  $ cp /usr/local/lib64/libssl.so.1.1 /usr/lib64/libssl.so.1.1

• openssl: error while loading shared libraries: libcrypto.so.1.1: cannot open shared object file: No such file or directory 에러 발생

  $ cp /usr/local/lib64/libcrypto.so.1.1 /usr/lib64/libcrypto.so.1.1

• 에러 해결 후 openssl 버전 재확인

  $ openssl version
  OpenSSL 1.1.1o  3 May 2022

  
  

7. Openssl 1.1.1o 설치 정보 등록

• 아래의 명령어를 입력하여 Openssl 1.1.1o 설치 정보를 등록하여 다른 프로그램이 1.1.1o를 참조하도록 설정

• 라이브러리 등록

  $ echo "/usr/local/lib64/" >> /etc/ld.so.conf
  $ ldconfig -v
  ldconfig: Path `/opt/dell/srvadmin/lib64' given more than once
  ldconfig: Path `/opt/dell/srvadmin/lib64' given more than once
  ldconfig: Path `/opt/dell/srvadmin/lib64' given more than once
  ldconfig: Path `/opt/dell/srvadmin/lib64' given more than once
  ...생략...

• Openssl 1.1.1o 환경변수를 작성 → 테스트 필요

  $ cat > /etc/profile.d/openssl.sh << EOF
  export OPENSSL_PATH="/usr/local/bin/openssl"
  export OPENSSL_ROOT_DIR="/usr/local/ssl"
  export OPENSSL_LIBRARIES="/usr/local/lib/"
  export OPENSSL_INCLUDE_DIR="/usr/local/include/openssl/"
  PATH=$PATH:$OPENSSL_PATH
  EOF

• openssl 1.1.1o 환경변수가 잘 등록되었는지 확인 → 테스트 필요

  $ cat /etc/profile.d/openssl.sh
  export OPENSSL_PATH="/usr/local/bin/openssl"
  export OPENSSL_ROOT_DIR="/usr/local/ssl"
  export OPENSSL_LIBRARIES="/usr/local/lib/"
  export OPENSSL_INCLUDE_DIR="/usr/local/include/openssl/"
  PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin:

• 환경변수 파일의 실행 권한을 수정

  $ chmod 755 /etc/profile.d/openssl.sh

  
  

※ 참고

• 참고 URL : https://engineeringcode.tistory.com/134
• Openssl 페이지 : https://www.openssl.org/