openssl 1.0.2k-fips 升级到 openssl-3.0.3

近期公司内部安全扫描发现OpenSSL存在漏洞，需要升级。

下载地址：

Openssl官网：

https://www.openssl.org/source/

下载3.0.3地址：
https://www.openssl.org/source/openssl-3.0.3.tar.gz

查看本地Openssl版本

[root@somsapidev ~]# openssl version
OpenSSL 1.0.2k-fips  26 Jan 2017

下载最新的版本

wget https://www.openssl.org/source/openssl-3.0.3.tar.gz
或者本地下载之后上传到服务器上。

开始升级：

解压缩下载的文件包

[root@somsapidev openssl-3.0.3]# tar -xf openssl-3.0.3.tar.gz

[root@somsapidev openssl-3.0.3]#cd openssl-3.0.3

[root@somsapidev openssl-3.0.3]#mkdir /usr/local/ssl

生成 Makefile，为编译做准备

[root@somsapidev openssl-3.0.3]#./config --prefix=/usr/local/ssl/

Can't locate IPC/Cmd.pm in @INC (@INC contains: /root/openssl-3.0.3/util/perl /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 . /root/openssl-3.0.3/external/perl/Text-Template-1.56/lib) at /root/openssl-3.0.3/util/perl/OpenSSL/config.pm line 18.
BEGIN failed--compilation aborted at /root/openssl-3.0.3/util/perl/OpenSSL/config.pm line 18.
Compilation failed in require at /root/openssl-3.0.3/Configure line 23.
BEGIN failed--compilation aborted at /root/openssl-3.0.3/Configure line 23.

[root@somsapidev openssl-3.0.3]#yum install perl-ExtUtils-CBuilder perl-ExtUtils-MakeMaker

[root@somsapidev openssl-3.0.3]#./config --prefix=/usr/local/ssl/

编译和安装

[root@somsapidev openssl-3.0.3]#make -j 4
[root@somsapidev openssl-3.0.3]#make install

备份和配置软链接

[root@somsapidev openssl-3.0.3]# mv /usr/bin/openssl /usr/bin/openssl.old
[root@somsapidev openssl-3.0.3]# mv /usr/include/openssl/ /usr/include/openssl.old
mv: cannot stat ‘/usr/include/openssl/’: No such file or directory
[root@somsapidev openssl-3.0.3]# ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl
[root@somsapidev openssl-3.0.3]# ln -s /usr/local/ssl/include/openssl /usr/include/openssl

生效和查看版本

[root@somsapidev openssl-3.0.3]# ldconfig   ​
ldconfig是一个动态链接库管理命令，其目的为了让动态链接库为系统所共享
[root@somsapidev openssl-3.0.3]# openssl version
OpenSSL 3.0.3 3 May 2022 (Library: OpenSSL 3.0.3 3 May 2022)
[root@somsapidev openssl-3.0.3]# openssl version -a
OpenSSL 3.0.3 3 May 2022 (Library: OpenSSL 3.0.3 3 May 2022)
built on: Wed Jun  8 02:17:09 2022 UTC
platform: linux-x86_64
options:  bn(64,64)
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -O3 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_BUILDING_OPENSSL -DNDEBUG
OPENSSLDIR: "/usr/local/ssl/ssl"
ENGINESDIR: "/usr/local/ssl//lib64/engines-3"
MODULESDIR: "/usr/local/ssl//lib64/ossl-modules"
Seeding source: os-specific
CPUINFO: OPENSSL_ia32cap=0x81b822015f8bffff:0x2