Intro
I have an ancient Redhat system which I’m not in a position to upgrade. I like to use curl to test web sites, but it’s getting to the point that my ancient version has no SSL versions in common with some secure web sites. I desperately wanted to upgrade curl while leaving the rest of the system as is. Is it even possible? How would you do it? All these things and more are explained in today’s riveting blog post.
The details
Redhat version
I don’t know the proper command so I do this:
$ cat /etc/system-release
ed Hat Enterprise Linux Server release 6.6 (Santiago) |
Current curl version
$ ./curl ‐‐version
curl 7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.16.2.3 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2 |
Limited set of SSL/TLS protocols
$ curl ‐help
... -2/--sslv2 Use SSLv2 (SSL) -3/--sslv3 Use SSLv3 (SSL) ... -z/--time-cond <time> Transfer based on a time condition -1/--tlsv1 Use TLSv1 (SSL) ... |
New version of curl
curl 7.55.1 (x86_64-unknown-linux-gnu) libcurl/7.55.1 OpenSSL/1.1.0f zlib/1.2.3 |
New SSL options
--ssl Try SSL/TLS
--ssl-allow-beast Allow security flaw to improve interop
--ssl-no-revoke Disable cert revocation checks (WinSSL)
--ssl-reqd Require SSL/TLS
-2, --sslv2 Use SSLv2
-3, --sslv3 Use SSLv3
...
--tls-max <VERSION> Use TLSv1.0 or greater
--tlsauthtype <type> TLS authentication type
--tlspassword TLS password
--tlsuser <name> TLS user name
-1, --tlsv1 Use TLSv1.0 or greater
--tlsv1.0 Use TLSv1.0
--tlsv1.1 Use TLSv1.1
--tlsv1.2 Use TLSv1.2
--tlsv1.3 Use TLSv1.3 |
Now that’s an upgrade! How did we get to this point?
Well, I tried to get a curl RPM – seems like the appropriate path for a lazy system administrator, right? Well, not so fast. It’s not hard to find an RPM, but trying to install one showed a lot of missing dependencies, as in this example:
$ sudo rpm ‐i curl‐minimal‐7.55.1‐2.0.cf.fc27.x86_64.rpm
warning: curl-minimal-7.55.1-2.0.cf.fc27.x86_64.rpm: Header V4 DSA/SHA1 Signature, key ID b56a8bac: NOKEY
error: Failed dependencies:
libc.so.6(GLIBC_2.14)(64bit) is needed by curl-minimal-7.55.1-2.0.cf.fc27.x86_64
libc.so.6(GLIBC_2.17)(64bit) is needed by curl-minimal-7.55.1-2.0.cf.fc27.x86_64
libcrypto.so.1.1()(64bit) is needed by curl-minimal-7.55.1-2.0.cf.fc27.x86_64
libcurl(x86-64) >= 7.55.1-2.0.cf.fc27 is needed by curl-minimal-7.55.1-2.0.cf.fc27.x86_64
libssl.so.1.1()(64bit) is needed by curl-minimal-7.55.1-2.0.cf.fc27.x86_64
curl conflicts with curl-minimal-7.55.1-2.0.cf.fc27.x86_64 |
So I looked at the libcurl RPM, but it had its own set of dependencies. Pretty soon it looks like a full-time job to get this thing compiled!
I found the instructions mentioned in the reference, but they didn’t work for me exactly like that. Besides, I don’t have a working git program. So here’s what I did.
Compiling openssl
I downloaded the latest openssl, 1.1.0f, from https://www.openssl.org/source/ , untar it, go into the openssl-1.1.0f directory, and then:
$ ./config ‐Wl,‐‐enable‐new‐dtags ‐‐prefix=/usr/local/ssl ‐‐openssldir=/usr/local/ssl
$ make depend
$ make
$ sudo make install
So far so good.
Compiling zlib
For zlib I was lazy and mostly followed the other guy’s commands. Went something like this:
$ lib=zlib-1.2.11
$ wget http://zlib.net/$lib.tar.gz
$ tar xzvf $lib.tar.gz
$ mv $lib zlib
$ cd zlib
$ ./configure
$ make
$ cd ..
$ CD=$(pwd)
No problems there…
Compiling curl
curl was tricky and when I followed the guy’s instructions I got the very problem he sought to avoid.
vtls/openssl.c: In function ‘Curl_ossl_seed’: vtls/openssl.c:276: error: implicit declaration of function ‘RAND_egd’ make[2]: *** [libcurl_la-openssl.lo] Error 1 make[2]: Leaving directory `/usr/local/src/curl/curl-7.55.1/lib' make[1]: *** [all] Error 2 make[1]: Leaving directory `/usr/local/src/curl/curl-7.55.1/lib' make: *** [all-recursive] Error 1 |
I looked at the source and decided that what might help is to add a hint where the openssl stuff could be found.
Backing up a bit, I got the source from https://curl.haxx.se/download.html. I chose the file curl-7.55.1.tar.gz. Untar it, go into the curl-7.55.1 directory,
$ ./buildconf
$ PKG_CONFIG_PATH=/usr/local/ssl/lib/pkgconfig LIBS=”‐ldl”
and then – here is the single most important point in the whole blog – configure it thusly:
$ ./configure ‐‐with‐zlib=$CD/zlib ‐‐disable‐shared ‐‐with‐ssl=/usr/local/ssl
So my insight was to add the ‐‐with‐ssl=/usr/local/ssl to the configure command.
Then of course you make it:
$ make
and maybe even install it:
$ make install
This put curl into /usr/local/bin. I actually made a sym link and made this the default version with this kludge (the following commands were run as root):
$ cd /usr/bin; mv curl{,.orig}; ln ‐s /usr/local/bin/curl
That’s it! That worked and produced a working, modern curl.
By the way it mentions TLS1.3, but when you try to use it:
$ curl ‐i ‐k ‐‐tlsv1.3 https://drjohnstechtalk.com/
curl: (4) OpenSSL was built without TLS 1.3 support |
It’s a no go. But at least TLS1.2 works just fine in this version.
One other thing – put shared libraries in a common area
I copied my compiled curl from Redhat to a SLES 11 SP 3 system. It didn’t quite run. Only thing is, it was missing the openssl libraries. So I guess it’s also important to copy over
libssl.so.1.1
libcrypto.so.1.1
to /usr/lib64 from /usr/local/lib64.
Once I did that, it worked like a charm!
Conclusion
We show how to compile the latest version of openssl and curl on an older Redhat 6.x OS. The motivation for doing so was to remain compatible with web sites which are already or soon dropping their support for TLS 1.0. With the compiled version curl and openssl supports TLS 1.2 which should keep it useful for a long while.
References and related
I closely followed the instructions in this stackoverflow post: https://stackoverflow.com/questions/44270707/cant-build-latest-libcurl-on-rhel-7-3#44297265
openssl source: https://www.openssl.org/source/
curl sources: https://curl.haxx.se/download.html
Here’s a web site that only supports TLS 1.2 which shows the problem: https://www.askapache.com/. You can see for yourself on ssllabs.com