Security OpenSSL 1.1.1 EOL Alternatives

OpenSSL 1.1.1 is now end of life with no more security updates. The last public release was OpenSSL 1.1.1w with options to pay OpenSSL folks (openssl.org) for extended OpenSSL 1.1.1 support which is now at OpenSSL 1.1.1y. OpenSSL 1.1.1 was a long term stable release (LTS). The next OpenSSL LTS release is OpenSSL 3.0 which is supported until September 7, 2026. OpenSSL 3.1 is short term release supported until March 14, 2025. OpenSSL 3.2/3.3 are development releases with shorter term support.

If you like and appreciate the work and development I do for Centmin Mod, please consider supporting Centmin Mod

Centmin Mod OpenSSL Usage

Centmin Mod uses OpenSSL at 2 levels

1. CentOS 7 for Centmin Mod 124.00stable/130.00beta01 or AlmaLinux/Rocky Linux 8/9 (Centmin Mod 130.00beta01 or newer) operating systems have their own default OpenSSL versions. CentOS 7 uses system OpenSSL 1.0.2, EL8 uses OpenSSL 1.1.1k and EL9 uses OpenSSL 3.0.7. They all backport security fixes and keep the same version number so you can't judge if they are out of date by version numbers. You do not need to worry about system level OpenSSL versions, they are taken care of for the life of OS support which is 10yrs, EL8 supported until June 2029 and EL9 until May 2032.
2. Centmin Mod Nginx builds its crypto library to default to OpenSSL 1.1.1w for EL7, and now EL8 system OpenSSL 1.1.1k and EL9 system OpenSSL 3.0.7. But Centmin Mod also optionally supports several crypto libraries, which include:
   • OpenSSL 3.0, 3.1, 3.2, 3.3. Centmin Mod 124.00stable max supported OpenSSL 3.0. Centmin Mod 130.00beta01, 131.00stable, 140.00beta01 or newer for OpenSSL 3.1, 3.2 and 3.3 support. Has dual RSA+ECDSA SSL certificate and OCSP stapling support. No Nginx HTTP/3 QUIC support.
   • LibreSSL. Centmin Mod 124.00stable/130.00beta01/131.00stable/140.00beta01 supported. Has dual RSA+ECDSA SSL certificate and OCSP stapling support. Nginx HTTP/3 QUIC supported in Centmin Mod 130.00beta01/131.00stable/140.00beta01 or newer.
   • BoringSSL. Centmin Mod 130.00beta01/131.00stable/140.00beta01 or latest BoringSSL supported. You lose dual RSA+ECDSA SSL certificate and OCSP stapling support compared to OpenSSL. Nginx HTTP/3 QUIC supported in Centmin Mod 130.00beta01/131.00stable/140.00beta01 or newer.
   • quicTLS OpenSSL 1.1.1/3.1.5 HTTP/3 QUIC fork. Centmin Mod 130.00beta01/131.00stable/140.00beta01 or higher only supported. Has dual RSA+ECDSA SSL certificate and OCSP stapling support. Nginx HTTP/3 QUIC supported in Centmin Mod 130.00beta01/131.00stable/140.00beta01 or newer.
   • Amazon's AWS-LC crypto libraries which is based on BoringSSL + OpenSSL 1.1.1 for HTTP/3 QUIC support. EL8/EL9 only + Centmin Mod 140.00beta01 or higher only supported. AWS-LC is listed as having dual RSA+ECDSA SSL certificate and OCSP stapling support like OpenSSL. Nginx HTTP/3 QUIC supported in Centmin Mod 140.00beta01 or newer.
   • When you loose dual RSA+ECDSA SSL certificate and have both RSA 2048bit and ECDSA 256bit SSL certificates issuance and installed when you enable DUALCERTS='y' in persistent config file /etc/centminmod/custom_config.inc, Centmin Mod will only serve visitors the ECDSA 256bit SSL certificate and not conditional serve RSA 2048bit when web browsers or clients do not support ECDSA 256bit SSL certificates. Only a concern if you have visitor traffic that is using very very old browsers and devices and only a concern if you aren't using Cloudflare in front of Centmin Mod Nginx. With Cloudflare, visitors will connect to Cloudflare's Edge servers and that has proper dual SSL cert and OCSP stapling support.
   • In terms of performance currently the rank: AWS-LC > BoringSSL > OpenSSL 1.1.1/quicTLS OpenSSL 1.1.1 > OpenSSL 3.3 > OpenSSL 3.2 > OpenSSL 3.1/quicTLS OpenSSL 3.1.5 > OpenSSL 3.0/quickTLS OpenSSL 3.0 > LibreSSL
   • The current leading contender to replace OpenSSL 1.1.1 defaults is Amazon AWS-LC due to performance being better than OpenSSL 1.1.1 and it supports HTTP/3 QUIC enablement, and you don't lose dual RSA + ECDA SSL certificate support or OCSP stapling support as you do with BoringSSL (2nd place contender for replacing OpenSSL 1.1.1) with Nginx. Currently, testing AWS-LC.

You can tell which crypto library and version is used with Nginx on SSH command line type:

Code (Text):

nginx -V

look for built with line which in the below example output is Centmin Mod Nginx built with AWS-LC 1.29.0 - OpenSSL 1.1.1 (compatible; AWS-LC 1.29.0) (running with AWS-LC 1.29.0) on AlmaLinux 8 with AWS_LC_SWITCH='y' in the persistent config file /etc/centminmod/custom_config.inc prior to running centmin.sh menu option 4

Code (Text):

nginx -V
nginx version: nginx/1.27.0 (190624-230227-almalinux8-9c1acda-br-a71f931)
built by gcc 13.1.1 20230614 (Red Hat 13.1.1-4) (GCC)
built with OpenSSL 1.1.1 (compatible; AWS-LC 1.29.0) (running with AWS-LC 1.29.0)

This example is built with system OpenSSL 3.07 on AlmaLinux 9. System OpenSSL versions without the FIPS label

Code (Text):

nginx -V
nginx version: nginx/1.27.0 (140724-004656-almalinux9-kvm-2425f5d)
built by gcc 13.2.1 20231205 (Red Hat 13.2.1-6) (GCC)
built with OpenSSL 3.0.7 1 Nov 2022

You can verify it's system OpenSSL version via rpm command

Code (Text):

rpm -q openssl
openssl-3.0.7-27.el9.x86_64

This example is built with system OpenSSL 1.1.1k FIPS on AlmaLinux 8. System OpenSSL versions usually will also be labelled with FIPS

Code (Text):

nginx -V
nginx version: nginx/1.27.0 (200624-001808-almalinux8-kvm-42a6e88-br-a71f931)
built by gcc 13.2.1 20231205 (Red Hat 13.2.1-6) (GCC)
built with OpenSSL 1.1.1k  FIPS 25 Mar 2021

You can verify it's system OpenSSL version via rpm command

Code (Text):

rpm -q openssl
openssl-1.1.1k-9.el8_7.x86_64

---

Example with OpenSSL 3.2.1 on AlmaLinux 8

Code (Text):

nginx -V
nginx version: nginx/1.27.0 (200624-155110-almalinux8-kvm-af1a938-br-a71f931)
built by gcc 13.2.1 20231205 (Red Hat 13.2.1-6) (GCC)
built with OpenSSL 3.2.1 30 Jan 2024

Example with BoringSSL on AlmaLinux 8 when you enable it via BORINGSSL_SWITCH='y' in the persistent config file /etc/centminmod/custom_config.inc prior to running centmin.sh menu option 4

Code (Text):

nginx -V
nginx version: nginx/1.27.0 (200624-160228-almalinux8-kvm-af1a938-br-a71f931)
built by gcc 13.2.1 20231205 (Red Hat 13.2.1-6) (GCC)
built with OpenSSL 1.1.1 (compatible; BoringSSL) (running with BoringSSL)

Example with LibreSSL on AlmaLinux 8 when set with LIBRESSL_SWITCH='y' and LIBRESSL_VERSION='3.8.4' in the persistent config file /etc/centminmod/custom_config.inc prior to running centmin.sh menu option 4

Code (Text):

nginx -V
nginx version: nginx/1.27.0 (200624-160903-almalinux8-kvm-af1a938-br-a71f931)
built by gcc 13.2.1 20231205 (Red Hat 13.2.1-6) (GCC)
built with LibreSSL 3.8.4

Example with LibreSSL on AlmaLinux 8 when set with LIBRESSL_SWITCH='y' and LIBRESSL_VERSION='3.9.2' in the persistent config file /etc/centminmod/custom_config.inc prior to running centmin.sh menu option 4

Code (Text):

nginx -V
nginx version: nginx/1.27.0 (200624-161343-almalinux8-kvm-af1a938-br-a71f931)
built by gcc 13.2.1 20231205 (Red Hat 13.2.1-6) (GCC)
built with LibreSSL 3.9.2

Example with quicTLS OpenSSL 1.1.1w QUIC fork for Nginx HTTP/3 when set with OPENSSL_SYSTEM_USE='n' and NGINX_QUIC_SUPPORT='y' and OPENSSL_QUIC_VERSION='OpenSSL_1_1_1w+quic' in the persistent config file /etc/centminmod/custom_config.inc prior to running centmin.sh menu option 4

Code (Text):

nginx -V
nginx version: nginx/1.27.0 (200624-163123-almalinux8-kvm-af1a938-br-a71f931)
built by gcc 13.2.1 20231205 (Red Hat 13.2.1-6) (GCC)
built with OpenSSL 1.1.1w+quic  11 Sep 2023

Example with quicTLS OpenSSL 3.0.14w QUIC fork for Nginx HTTP/3 when set with OPENSSL_SYSTEM_USE='n' and NGINX_QUIC_SUPPORT='y' and OPENSSL_QUIC_VERSION='openssl-3.0.14+quic' in the persistent config file /etc/centminmod/custom_config.inc prior to running centmin.sh menu option 4

Code (Text):

nginx -V
nginx version: nginx/1.27.0 (270624-021323-almalinux9-kvm-7e168f1)
built by gcc 13.2.1 20231205 (Red Hat 13.2.1-6) (GCC)
built with OpenSSL 3.0.14 4 Jun 2024

Seems for, Nginx -V isn't showing OpenSSL 3.0.14w+quic but OpenSSL 3.0.14 but inspecting nginx binary does show it using it for libssl.so.3 and libcrypto.so.3 paths to /opt/openssl-quic/lib

Code (Text):

ldd $(which nginx)
        linux-vdso.so.1 (0x00007ffe1cdbd000)
        libssl.so.3 => /opt/openssl-quic/lib/libssl.so.3 (0x00007fdf53757000)
        libcrypto.so.3 => /opt/openssl-quic/lib/libcrypto.so.3 (0x00007fdf53200000)
        libjemalloc.so.2 => /lib64/libjemalloc.so.2 (0x00007fdf52e00000)
        libcrypt.so.2 => /lib64/libcrypt.so.2 (0x00007fdf5371d000)
        libpcre.so.1 => /usr/local/nginx-dep/lib/libpcre.so.1 (0x00007fdf52a00000)
        libGeoIP.so.1 => /lib64/libGeoIP.so.1 (0x00007fdf536de000)
        libatomic_ops.so.1 => /lib64/libatomic_ops.so.1 (0x00007fdf53aed000)
        libc.so.6 => /lib64/libc.so.6 (0x00007fdf52600000)
        libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fdf53ae8000)
        /lib64/ld-linux-x86-64.so.2 (0x00007fdf53b03000)

Example with quicTLS OpenSSL 3.1.5 QUIC fork for Nginx HTTP/3 when set with OPENSSL_SYSTEM_USE='n' and NGINX_QUIC_SUPPORT='y' and OPENSSL_QUIC_VERSION='openssl-3.1.5+quic' in the persistent config file /etc/centminmod/custom_config.inc prior to running centmin.sh menu option 4

Code (Text):

nginx -V
nginx version: nginx/1.27.0 (270624-020317-almalinux9-kvm-7e168f1)
built by gcc 13.2.1 20231205 (Red Hat 13.2.1-6) (GCC)
built with OpenSSL 3.1.5+quic 30 Jan 2024

Mitigations

If you use Centmin Mod Nginx with Cloudflare orange cloud-enabled CDN proxy in front of Centmin Mod Nginx, then only Cloudflare Edge servers are connecting and communicating with Centmin Mod Nginx and its used crypto library, which is OpenSSL by default. Visitors to your sites will be connecting and communicating only with Cloudflare's CDN edge servers.

Centmin Mod Nginx Workarounds for Nginx OpenSSL 1.1.1

Use Distro OS's OpenSSL

Centmin Mod Nginx routines support the variable OPENSSL_SYSTEM_USE='y' which tells Centmin Mod to build Nginx with EL8 system OpenSSL 1.1.1k which has backported patches but stays on 1.1.1 version number and EL9 system OpenSSL 3.0.7 which has backported patches but stays on 3.0.7 version number. For EL8/EL9 systems, the default is to now use OPENSSL_SYSTEM_USE='y'. If you are using CentOS 7 (EL7) system Centmin Mod Nginx by default compiles OpenSSL 1.1.1w as EL7 system OpenSSL 1.0.2 does not support HTTP/2 or TLSv1.3 as those features were added in OpenSSL 1.1.1.

Use AWS-LC

If on Centmin Mod 130.00beta01/131.00stable/140.00beta01 or newer based EL8/EL9 system you can switch Centmin Mod Nginx to use Amazon AWS-LC crypto library instead at https://community.centminmod.com/th...crypto-library-support-in-130-00beta01.25415/ via setting the variable AWS_LC_SWITCH='y' in persistent config file /etc/centminmod/custom_config.inc (if the persistent config doesn't exist create it) and run cmupdate command + recompile Nginx via centmin.sh menu option 4. This will switch from Centmin Mod Nginx OpenSSL default 1.1.1w (as of June 21, 2024) to Amazon AWS-LC crypto library which is based off a mix of BoringSSL and OpenSSL 1.1.1.

Use Newer OpenSSL Versions

The other alternative to AWS-LC if you don't mind slower Nginx/OpenSSL, is to use OpenSSL 3.0/3.1/3.2 via 4 variables override in persistent config file /etc/centminmod/custom_config.inc and then run cmupdate and then centmin.sh menu option 4 to recompile Nginx with desired OpenSSL version. Of course then you'd need to keep up to date on OpenSSL version releases at openssl.org. I haven't decided on new Centmin Mod Nginx crypto library default as OpenSSL 3.0/3.1/3.2 is much slower than OpenSSL 1.1.1 while BoringSSL and AWS-LC are actually faster than OpenSSL 1.1.1 for ECDSA ciphers at least. Once I decide, I will update 130.00beta01 or newer with the new defaults.

Switch from Centmin Mod Nginx OpenSSL 1.1.1w default to OpenSSL 3.2.1

Code (Text):

OPENSSL_SYSTEM_USE='n'
OPENSSL_QUIC_VERSION='openssl-3.1.5+quic'
OPENSSL_VERSION='3.2.1'
OPENSSL_VERSIONFALLBACK='3.2.1'
OPENSSL_VERSION_OLDOVERRIDE='3.2.1'

Switch from Centmin Mod Nginx OpenSSL 1.1.1w default to OpenSSL 3.1.5

Code (Text):

OPENSSL_SYSTEM_USE='n'
OPENSSL_QUIC_VERSION='openssl-3.1.5+quic'
OPENSSL_VERSION='3.1.5'
OPENSSL_VERSIONFALLBACK='3.1.5'
OPENSSL_VERSION_OLDOVERRIDE='3.1.5'

Switch from Centmin Mod Nginx OpenSSL 1.1.1w default to OpenSSL 3.0.14

Code (Text):

OPENSSL_SYSTEM_USE='n'
OPENSSL_QUIC_VERSION='openssl-3.1.5+quic'
OPENSSL_VERSION='3.0.14'
OPENSSL_VERSIONFALLBACK='3.0.14'
OPENSSL_VERSION_OLDOVERRIDE='3.0.14'

AFAIK as of June 21, 2024 AEST there are no known applicable security issues with OpenSSL 1.1.1w for TLS server i.e. Nginx, all the listed security vulnerabilities that are addressed in OpenSSL 1.1.1y are for non-TLS server usage cases (non web server)

 

Update Centmin Mod 140.00beta01 and newer has also added optional Nginx OpenSSL 3.4.0 support https://community.centminmod.com/th...-openssl-3-4-0-support-in-140-00beta01.26665/. OpenSSL 3.4.0 was released yesterday October 22, 2024

Code (Text):

OPENSSL_SYSTEM_USE='n'
OPENSSL_VERSION='3.4.0'
OPENSSL_VERSIONFALLBACK='3.4.0'
OPENSSL_VERSION_OLDOVERRIDE='3.4.0'