RHEL/CentOS 6 OpenSSL client compatibility after DST Root CA X3 expiration

Woohoo! I did it too! Full list of commands on a "fresh" CentOS 6 Docker image:

yum install wget
yum install krb5-devel zlib-devel lksctp-tools-devel util-linux make gcc rpm-build
curl -o openssl-1.0.2k-21.el7_9.src.rpm https://vault.centos.org/7.9.2009/updates/Source/SPackages/openssl-1.0.2k-21.el7_9.src.rpm
rpm -i openssl-1.0.2k-21.el7_9.src.rpm
cd ~/rpmbuild/SOURCES/
sed -i 's/secure_getenv(/getenv(/g' *patch
cd ../SPECS/
sed -i 's/%patch68 -p1 -b .secure-getenv/#%patch68 -p1 -b .secure-getenv/g' openssl.spec
rpmbuild -bb openssl.spec
cd ../RPMS/x86_64
rpm -U openssl-libs-1.0.2k-21.el6.x86_64.rpm openssl-1.0.2k-21.el6.x86_64.rpm

Not sure if openssl-devel-1.0.2k-21.el6.x86_64.rpm would be required, but for regular use I'm guessing it's not.

@Osiris The -devel package (for any package) contains just include files, only needed to build other packages depending on this one, not needed for regular operations. You can safely remove them.

@alan3188 The dependency failures are because on CentOS 7 (where we took the spec file from), the openssl package is split into "openssl" and "openssl-libs", but on CentOS 6 you had only "openssl". So you need to explicitly install the -libs package at the same time.

(which is why I suggested to merge them back into one, but that's another bit more work on the spec file. once you get it installed, it doesn't matter anymore.)

Thanks for the help folks, I still get a curious error when trying to update/install the rpm (existing latest openssl in centos 6 is 1.0.1e)...

error: Failed dependencies:
openssl-devel = 1.0.1e-58.el6_10 is needed by (installed) openssl-static-1.0.1e-58.el6_10.x86_64

However, yum install openssl-devel
Package openssl-devel-1.0.1e-58.el6_10.x86_64 already installed and latest version

EDIT think I fixed it by including the static and source file rpms as well at the same time.
Thanks for all the help.

You won't need to install the source RPM, but that message indicates that your existing version of openssl-static doesn't like that you are upgrading openssl-devel and trying to leave it back on the old version, so the correct fix is just to install openssl-static in the same command like you did!

For all interested parties. I've modified openssl.spec to incorporate shared files back into monolitic RPM file to match EL6 package contents.
URL for corresponding binary and source packages (openssl and ca-certificates) + openssl.spec is
https://server-support.co/openssl-el6/ 46

Thank you very much for the summation @futureweb!

For openssl update needed to remove a python-libs-2.6.6-68.el6_10.i686 package from 6.10 @updates repo, as it had a fixed dependency that prevented the openssl install. It removed cleanly though, nothing using it apparently.

yum remove python-libs-2.6.6-68.el6_10.i686

due to:

error: Failed dependencies:
        libcrypto.so.10 is needed by (installed) python-libs-2.6.6-68.el6_10.i686
        libcrypto.so.10(libcrypto.so.10) is needed by (installed) python-libs-2.6.6-68.el6_10.i686
        libssl.so.10 is needed by (installed) python-libs-2.6.6-68.el6_10.i686
        libssl.so.10(libssl.so.10) is needed by (installed) python-libs-2.6.6-68.el6_10.i686

For the certificates update, I needed following changes:

1. Add "-p": mkdir -p /dl/ca-cert; cd /dl/ca-cert;
2. Add "cd ~/rpmbuild/SPECS" before "rpmbuild -bb ca-certificates.spec"

Signed up just to say thanks. The comments in this thread are pure gold. @futureweb incorporated the comments from many in this thread into a perfect post on building the openssl & ca-certificate packages in post #73. I happened to load these into Spacewalk, and yum is smart enough to install the openssl-libs on upgrade of openssl.

Thanks!

Hi @yaylife and welcome to the LE community forum

I can't think of a better compliment

Wow, this openssl mailing list post 20 has a much simpler solution for CentOS 6 / openssl < 1.0.2

Since openssl apparantly doesn't check the self-signature on root CA's, you can simply alter the expiration date of DST Root CA X3, and it will be trusted again. The following command fudges the expiration date to 30 September 2024 (the end-date of the ISRG Root X1 cross-signature) directly in the PEM-encoded certificate:

sudo sed -i s/xMDkzMDE0MDExNVow/0MDkzMDE4MTQwM1ow/ /etc/pki/tls/certs/ca-bundle.crt

This works no openssl upgrade needed!

This trades one problem for another... but maybe this one is less problematic (for some):

image832×521 14 KB

At least this is not problematic for OpenSSL, which ignores the (now broken) self-signature.
Other applications & libraries should be able to anchor any LE chain to ISRG Root X1 directly, ignoring DST Root CA X3 completely (either because it's expired or corrupted), this was an OpenSSL-specific issue.

if it doen'st care about self-sign then would it need to keep same issuer? not sure intermediate from unknown issuer in trust store would work though

I'm pretty sure users using this hack will know of the altered state. And as it's a client thing and not a server thing, it wouldn't influence anything else but the user when inspecting the altered certificate. Sooooo, this doesn't really matter.