====== 31 CentOS5 でTLS1.2 ======

CentOS5 の opensslが、openssl-0.9.8e-34.el5_11
これだとTLS1.2に対応してないので、curlやwgetなどやると下記のエラーになってしまう。。。

  error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version


===== OpenSSLバージョン確認 =====

<code>
# openssl version
OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008
</code>

===== 対応 =====

新しいOpensslを入れてあげる


<code>
# yum install gcc gnutls-devel
</code>

==== Openssl ====

<code>
# wget https://www.openssl.org/source/openssl-1.0.2r.tar.gz
# tar zxvf openssl-1.0.2r.tar.gz
# cd openssl-1.0.2r
# ./config shared enable-ssl2 enable-ssl3 --prefix=/opt/openssl-1.0.2r
# make
# make install
# /opt/openssl-1.0.2r/bin/openssl version
OpenSSL 1.0.2r  26 Feb 2019
</code>

=== Pathを通す ===
<code>
# mv /usr/bin/openssl /usr/bin/openssl.bak
# ln -s /opt/openssl-1.0.2r/bin/openssl /usr/bin/openssl
# echo '/opt/openssl-1.0.2r/lib' > /etc/ld.so.conf.d/openssl.conf
</code>

=== ライブラリ読み込み ===

<code>
# ldconfig
</code>

==== Wget ====

1.16.1以上でtls1.1 tls1.2対応
<code>
# wget http://ftp.gnu.org/gnu/wget/wget-1.16.1.tar.gz
# tar -xzvf wget-1.16.1.tar.gz
# cd wget-1.16.1
# export PKG_CONFIG_PATH=/opt/openssl-1.0.2r/lib/pkgconfig/
※これを実行してないと古いopensslのpkgconfgを読んでしまう。

# ./configure --with-ssl=openssl  --prefix=/opt/wget-1.16.1 --with-libssl-prefix=/opt/openssl-1.0.2r/lib
# make && make install
</code>


=== ライブラリの確認 ===

libssl.so.1.0.0 => /opt/openssl-1.0.2r/lib/libssl.so.1.0.0が通っていればOK
<code>
# ldd /opt/wget-1.16.1/bin/wget 
	linux-vdso.so.1 =>  (0x00007fff5cdfd000)
	libuuid.so.1 => /lib64/libuuid.so.1 (0x0000003d02c00000)
	libssl.so.1.0.0 => /opt/openssl-1.0.2r/lib/libssl.so.1.0.0 (0x00002b3a5baa8000)
	libcrypto.so.1.0.0 => /opt/openssl-1.0.2r/lib/libcrypto.so.1.0.0 (0x00002b3a5bd1a000)
	libz.so.1 => /lib64/libz.so.1 (0x0000003d00400000)
	libidn.so.11 => /usr/lib64/libidn.so.11 (0x00000036ef000000)
	librt.so.1 => /lib64/librt.so.1 (0x0000003d01000000)
	libc.so.6 => /lib64/libc.so.6 (0x0000003cff400000)
	/lib64/ld-linux-x86-64.so.2 (0x0000003cff000000)
	libdl.so.2 => /lib64/libdl.so.2 (0x0000003cff800000)
	libpthread.so.0 => /lib64/libpthread.so.0 (0x0000003cffc00000)
</code>
=== CA証明書を指定しておく ===

CA証明書: [[50_dialy:2014:01:29]]

<code>
# /opt/wget-1.16.1/bin/wget --no-check-certificate  http://curl.haxx.se/ca/cacert.pem
# mv /etc/pki/tls/certs/ca-bundle.crt /etc/pki/tls/certs/ca-bundle.crt.org
# mv cacert.pem /etc/pki/tls/certs/ca-bundle.crt

# echo 'ca-certificate =/etc/pki/tls/certs/ca-bundle.crt' >> /opt/wget-1.16.1/etc/wgetrc
</code>

=== Pathも通しておく ===
<code>
# which wget
/usr/bin/wget
# mv /usr/bin/wget /usr/bin/wget.org
# ln -s /opt/wget-1.16.1/bin/wget /usr/bin/wget
</code>

==== Curl ====
<code>
# cd /usr/local/src
# wget https://curl.haxx.se/download/curl-7.58.0.tar.gz
# tar xzvf curl-7.58.0.tar.gz
# cd curl-7.58.0
# ./configure --enable-libcurl-option --with-ssl=/opt/openssl-1.0.2r/ --prefix=/opt/curl-7.58.0
# make
# make install
# /opt/curl-7.58.0/bin/curl --version
curl 7.58.0 (x86_64-pc-linux-gnu) libcurl/7.58.0 OpenSSL/1.0.2r zlib/1.2.3
Release-Date: 2018-01-24
</code>

=== Path通しておく ===

<code>
# which curl
/usr/bin/curl
# mv /usr/bin/curl /usr/bin/curl.org
# ln -s /opt/curl-7.58.0/bin/curl /usr/bin/curl
$ curl -L -O [URL]
</code>


{{tag>tls openssl TLS1.2}}