<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>I backported the redhat/centos 6.x OpenSSL rpm package to 5.x. It is running fine on centos 5 32bits. I can provide you the source rpm and you can recompile on your 64bit Os.<br><br>Saludos<div>Jose Alfredo Diaz</div><div>Cerrejón</div><div><br></div></div><div><br>On Apr 13, 2017, at 5:08 PM, Rob Lockhart <<a href="mailto:rlockhar@gmail.com">rlockhar@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr"><div class="gmail_default" style="color:rgb(11,83,148)">One more good link:</div><div class="gmail_default"><a href="https://wiki.openssl.org/index.php/Compilation_and_Installation"><font color="#0b5394">https://wiki.openssl.org/index.php/Compilation_and_Installation</font><br></a></div><div class="gmail_default"><font color="#0b5394">Be sure to read the parts about the --prefix and --openssldir compiler directives. The FIPS mode puts restrictions on some keys (prohibiting weak ones), but IIRC you can do the same with proper config files too.</font></div><div class="gmail_default"><font color="#0b5394"><br></font></div><div class="gmail_default"><font color="#0b5394">Good luck!</font></div><div class="gmail_default"><br></div><div class="gmail_extra"><div class="gmail_quote">On Thu, Apr 13, 2017 at 5:32 PM, Kenway Ng <span dir="ltr"><<a href="mailto:kenwayng@gmail.com" target="_blank">kenwayng@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Thanks Rob. Appreciate the information.<br><br><div class="gmail_quote"><div><div class="gmail-h5"><div dir="ltr">On Thu, Apr 13, 2017, 4:28 PM Rob Lockhart <<a href="mailto:rlockhar@gmail.com" target="_blank">rlockhar@gmail.com</a>> wrote:<br></div></div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div class="gmail-h5"><div dir="ltr"><div><font color="#0b5394">According to this:</font><br><font color="#0b5394"><a href="https://access.redhat.com/support/policy/updates/errata" target="_blank">https://access.redhat.com/<wbr>support/policy/updates/errata</a></font><br></div><div><font color="#0b5394"><br></font></div><div><font color="#0b5394">RHEL5 is out of support as of 3/31/2017 for patches, except for security patching. No new features will be added to RHEL5, to include TLS v1.1 support (requires OpenSSL 1.0.x).</font></div><div><font color="#0b5394"><br></font></div><div><font color="#0b5394">First compile OpenSSL 1.0.2 (in a different path), then compile Stunnel (5.41) using the /usr/local for the prefix (per previous links), and perhaps some other switches too (based on info from those URLs).</font></div><div><font color="#0b5394"><br></font></div><div><font color="#0b5394">From the links I found, you can have multiple versions of OpenSSL, but you have to link to one when compiling Stunnel. The one you choose when compiling Stunnel will want to be the newer one you compiled. IMHO, I would migrate your RHEL5 to RHEL6 or RHEL7, but that may be considerably more difficult than just compiling OpenSSL and Stunnel.</font></div><div class="gmail_extra"><br></div><div class="gmail_extra"><div style="color:rgb(11,83,148)"> -Rob</div></div></div><div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Apr 13, 2017 at 4:15 PM, Kenway Ng <span dir="ltr"><<a href="mailto:kenwayng@gmail.com" target="_blank">kenwayng@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Please let me know if I am completely off. The version of openssl we are running is 0.9.8e-fips-rhel5 01 Jul 2008. So if we want version TLS1.1+ then we need to recompile the STUNNEL src with an updated version of openssl we are running on our server. Something higher than 0.9.8. Is that right ? Is it possible to find a version that was already compiled with a higher version of openssl ? </div><div class="gmail-m_1201485802861874923m_4454364771371525849m_-2226237752742717635gmail-HOEnZb"><div class="gmail-m_1201485802861874923m_4454364771371525849m_-2226237752742717635gmail-h5"><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Apr 12, 2017 at 5:49 PM, Rob Lockhart <span dir="ltr"><<a href="mailto:rlockhar@gmail.com" target="_blank">rlockhar@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div style="color:rgb(11,83,148)"><br></div><div class="gmail_extra"><br><div class="gmail_quote"><span>On Wed, Apr 12, 2017 at 5:22 PM, Kenway Ng <span dir="ltr"><<a href="mailto:kenwayng@gmail.com" target="_blank">kenwayng@gmail.com</a>></span> wrote:<br></span><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><span><div><br></div><div>I am trying to upgrade our version of stunnel. Our SME left and now I am trying to upgrade stunnel to fix a vulnerability . I am being told to use TLS1.1 or higher</div><div><br></div></span><span><div><span style="font-size:12.8px">$ ./stunnel -version</span><br></div><div><p class="MsoNormal" style="font-size:12.8px"><u></u></p><p class="MsoNormal" style="font-size:12.8px">stunnel 4.15 on x86_64-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008<u></u><u></u></p><p class="MsoNormal" style="font-size:12.8px">Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP<u></u><u></u></p><p class="MsoNormal" style="font-size:12.8px"><u></u> </p></div></span></div></blockquote><div><br></div><div><div style="color:rgb(11,83,148)">I don't have RHEL5 64-bit but these links may help:</div><div style="color:rgb(11,83,148)"><br></div><div><a href="https://miteshshah.github.io/linux/centos/how-to-enable-openssl-1-0-2-a-tlsv1-1-and-tlsv1-2-on-centos-5-and-rhel5/" target="_blank"><font color="#0b5394">https://miteshshah.github.io/<wbr>linux/centos/how-to-enable-<wbr>openssl-1-0-2-a-tlsv1-1-and-<wbr>tlsv1-2-on-centos-5-and-rhel5/</font><br></a></div><div><font color="#0b5394"><br></font></div><div style="color:rgb(11,83,148)"><a href="http://serverfault.com/questions/296765/cannot-find-ssl-libraries-when-configuring-stunnel" target="_blank">http://serverfault.com/<wbr>questions/296765/cannot-find-<wbr>ssl-libraries-when-<wbr>configuring-stunnel</a></div><br></div><div><div style="color:rgb(11,83,148)">These links involve re-compiling OpenSSL and Stunnel, in that order. I would opt for OpenSSL 1.0.2k (latest as of 20170412) since 1.0.1 and below are all EOL as of 12/31/2016. OpenSSL 0.9.8 supports only TLS v1.0, whereas OpenSSL 1.0.1 supports TLS v1.0, v1.1 and v1.2. </div><span class="gmail-m_1201485802861874923m_4454364771371525849m_-2226237752742717635gmail-m_8092256319650824168HOEnZb"><font color="#888888"><div style="color:rgb(11,83,148)"><br></div><div style="color:rgb(11,83,148)"> -Rob</div></font></span></div></div></div></div>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div></div><div dir="ltr"><div class="gmail_extra"></div></div></div></div>
______________________________<wbr>_________________<br>
stunnel-users mailing list<br>
<a href="mailto:stunnel-users@stunnel.org" target="_blank">stunnel-users@stunnel.org</a><br>
<a href="https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users" rel="noreferrer" target="_blank">https://www.stunnel.org/cgi-<wbr>bin/mailman/listinfo/stunnel-<wbr>users</a><br>
</blockquote></div>
</blockquote></div><br></div></div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>stunnel-users mailing list</span><br><span><a href="mailto:stunnel-users@stunnel.org">stunnel-users@stunnel.org</a></span><br><span><a href="https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users">https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users</a></span><br></div></blockquote></body></html>