OpenSSL and TLS 1.1 and TLS 1.2 - should i update?

Question

Debian 6s openssl from apt-get is still on 0.9.8 (2010) and doesnt support TLS 1.1 and TLS 1.2. Is there anything why i should not update to the latest stable 1.0.1e ? Or, which build would u recommend with TLS 1.1/2 support.

Solution

Yes, you should update.
Specifically, you should update to Debian 7 (Wheezy) like Zoredache told you to.
There are LOTS of dependencies underlying Apache, and a full OS upgrade IS the "easiest way" to do this upgrade. It also gets you a lot of other security and functionality enhancements that have been made since Debian 6.

---

If you don't want to upgrade to Debian 7, you should probably stick with the old OpenSSL and Apache (bearing in mind all of the implications of doing so). Any upgrade done on Debian 6 would have to be done "the hard way".

---

If you insist on doing this the hard way you will need to download Apache, OpenSSL, and any other ancillary components (PHP, Passenger, mod_perl, etc.) that you use in your web server, and basically build a local OpenSSL, compile a custom Apache building against that SSL library, and then add all the ancillary components to your custom Apache environment.

You will of course then be responsible for tracking security updates to all of those components on your own, and rebuilding/reinstalling them as necessary.
It also leaves your core system running a different OpenSSL than your web server (which may or may not be a huge problem for you -- but it is something you need to be aware of when you're troubleshooting in the future.

This is all certainly do-able, but a step-by-step guide is out of scope for Server Fault (and frankly if you need such a guide you've no business doing this to begin with -- it's moderately advanced system administration like back in the bad-old-days before package management and if you're not up to that level of skill you need to play in a sandbox environment before attempting this in production).

Comments

[Zoredache]

You might as well update to wheezy (Debian 7). Updating just Apache won't really be possible. OpenSSL is compiled into many packages, which means you can't update it without rebuilding/upgrading all those packages.

[user2693017]

mhh, what would be the easiest way without updating to debian 7 ?

[Michael Hampton]

Getting rid of whoever is preventing you from updating.

[user2693017]

ok, so I have to update to debian 7. Is an update possible or do I have reinstall it. The point about this is, that I dont want to import the big forum mysql. This took hours the last time and I did it directly via shell.

[voretaq7]

I believe there is a Debian 6->7 upgrade process that does not require a full reinstall. That's something you'd have to check the Debian documentation about though.

[Zoredache]

You shouldn't need to re-install with Debian, provided you stick with official repositories, and have done all your management the Debian way. I have systems that started off their life running etch, but have been upgraded through lenny, squeeze to wheezy. Just take the time to read the install/upgrade guide and follow the directions.