Upgrade to Latest Version of OpenSSL on Ubuntu

In the security course I teach I ask students to use OpenSSL on the command line to perform various cryptographic operations. The most recent task was to generate and use RSA public/private keys. In preparing the task I tested all the commands at home on Ubuntu 11.10. After releasing to the students it didn't take long to receive feedback that my recommended commmands, in particular genpkey, didn't work. Turns out Ubuntu 11.10 runs OpenSSL v1.0.0e and includes the newer generic public key management commands that I recommended, but these commands are not supported in older versions of Ubuntu (our student server runs Ubuntu 10.04 LTS) running OpenSSL v0.9.8k. So here is how I "upgraded" our Ubuntu 10.04 LTS server to also run the latest version of OpenSSL v1.0.0g. The instructions are for specific versions, but with slight modification I'm confident it will work with other OpenSSL/Ubuntu versions. Download the OpenSSL v1.0.0g source:

$ wget http://www.openssl.org/source/openssl-1.0.0g.tar.gz

Unpack the archive and install:

$ tar xzvf openssl-1.0.0g.tar.gz
$ cd openssl-1.0.0g
$ ./config
$ make
$ make test
$ sudo make install

All files, including binaries and man pages are install under the directory /usr/local/ssl. To ensure users use this version of OpenSSL instead of the previous version you must update the paths for man pages and binaries. Edit the file /etc/manpath.config adding the following line before the first MANPATH_MAP:

MANPATH_MAP     /usr/local/ssl/bin      /usr/local/ssl/man

Update the man database (I honestly can't remember and don't know for sure if this command was necessary - maybe try without it and at the end when testing if the man pages are still the old versions come back and run mandb):

sudo mandb

Edit the file /etc/environment and insert the path for OpenSSL binaries (/usr/local/ssl/bin) before the path for Ubuntu's version of OpenSSL (/usr/bin). My environment file looks like this:

PATH="/usr/local/sbin:/usr/local/bin:/usr/local/ssl/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games"

Logout and login and test:

$ openssl version
OpenSSL 1.0.0g 18 Jan 2012

Also test the man pages by running man openssl and at the very bottom in the left hand corner it should report 1.0.0g. Note that although the users will now automatically use the new version of OpenSSL, existing programs (e.g. Apache) may not as they are linked against the libraries from the Ubuntu version.

Created on Wed, 07 Mar 2012, 2:27pm

Last changed on Wed, 16 May 2012, 8:51pm