Compiling Openssl 3.0

open ssl 3.0 was released recently current version is 1.1.1 so it is a major release since it is a new release there aren't any packages currently available for it but the source code is freely available and we're going to go through the steps of downloading and installing the source code now to install the source code um i'm going to use an all the linux system here and i'm also going to use a debian system to get the source code installed you have to get the development tools on both of the machines so for these fedora based systems like alma linux the command is dnf group install development tools and the development tools has to be in quotes and for the debian based system the command is apt install build essential i'm actually root on these boxes so i don't have to use pseudo so let me take that out when you run app install it does its thing and it goes down installs all the compilers that it needs and everything same thing on the ama linux box do the install it shows you all the packages it's going to download and install hit yes and let that go ahead and run and i will come back here once this is complete that took about three minutes on both machines to get all the development tools installed and there are some other packages that are needed for the installation are these are actually perl modules that are needed to do the install and if you want to run the make test later on you have to have this pearl module and i found that there were no debian packages for this module and this one and then for the fedora slash red hat i found there were no modules well no packages available for this one so we're going to have to manually install those missing modules using cpan which comes with perl so we're going to go first to the alma system and we're going to install the packages that are needed those are the plural modules that were available and i noticed that the alma linux fedora installation of the development tools didn't install cpin by default so you have to add cpan there and we're gonna go ahead and let that run okay i'm not pseudo on this box so i don't have to run pseudo i'm already root so it tells me it's going to install that now it's installing the packages that i requested plus it's installing any dependencies so these are all the dependencies and i tell it yes to go ahead and install now the package names are different on debian so i will copy those in all right here we are for debian the pearl are listed there and i noticed that the debian developer tools don't include git and the vi editor the basic text editor is not included by default so i'm going to add those in and i've got pseudo in here again take that pseudo out and it's going to install all the packages i asked for plus the dependencies i'll type y for yes and it will go through and install those additional packages now remember we had some packages that were not available so this test more needs to be installed manually with cpan so i will copy that and i will run cpan the first time you run it it wants to configure itself so i'll just say yes and the command is install and then the name of the module which is tests colon colon more it goes through it updates the current version of cpan and then it goes through and it downloads that module that i requested and it installs it now down below on the debian system it was missing two packages the ipc command and the pod html so i have to do the same thing with cpan i have to install those manually and this one's finished up here so i can exit and then come back down to the debian system where is it oh there it is okay under cpan again again first time install it wants to configure itself and i would install ipc dash cmd and it also finds a new version of cpan so what it tells me here is that it can't find the module listed that way so i have to find a module that's closely related to it that does the same thing and they tell you the command to run here which is the i with the module that you want inside the two slashes there so i'm going to run that command and look for an ipc cmd and i see one here and that looks like the closest thing to it where there's one down here but it looks like an older version a 0.22 so i'm going to go with the 1.04 version i'm going to copy that and copy the whole thing i'm going to tell it to install and it's going to go in and download and install that module and the other missing module was the pod dash html and we do the same thing with that do the install paste it in this pod and we get that message that it can't find pod dash html that says try this command so we try that command and again we look for a module that's similar and i tried um i tried this html easy and that one seemed to work i'm assuming it's just a version of the pod html i will copy that and i will install and that will go through and install all the modules that i need once we go to looking at the source code there's a readme file there that lists some of the modules that are required but it does not list all the modules i kind of figured out which ones are needed by running the compile and then looking for errors and finding the missing modules now that took a few minutes to finish so now we've got all the development tools and all the pearl modules that we need to actually start the installation so what we want to do um there's an announcement here from back in september that open ssl was released it says please download it from here and there's a link there which goes out to the open ssl source directory and i want to pull from the get repository where the master [Music] master sources are located and it tells you to run this command that clone that's going to copy the source code down to your local system and i'm going to make sure i'm in the root directory there and the command is the same forget so that is actually going to download the open ssl source code and put it on the system so all it's doing is going to their github site putting a local copy of the source code here on both of the boxes and we're going to use this ammo box so i'm going to make this window just a little bit larger see it created a directory called openssl i'm going to get rid of this to clear things up here and the ssl open ssl directory there are a bunch of files here we want to look at the install.md file they're just text files even though they end with md it gives you information tells you what you need pearl plural five it says core modules and you want to read this notes dot pearl for any additional modules tells you need c compiler we installed the c compiler on both earlier install that installed that gives you a little information about commands and basically you're gonna run a dot slash configure and that configure has a capital c uh you're gonna run a make and a make test and if that's all successful you run a make install so we're going to look at the notes that it had for pearl and it tells you about it says that they rely quite a bit on pearl that's why all those additional modules are needed so when you go down here it talks about required pearl modules it tells you the text template is required and the test more is you want to run the make test and it tells you how to find those and it also tells you how to install cpan and install templates just like we did before now i did a little reading on this configure and i found that if you're going to install it in the non-default folder which is normally slash opt you have to specify the prefix and also tell it what directory it's going to be installed in and the last option here is to enable fips let me copy that get out of here okay back on our back in our downloads page openssl supports fips which is uh some type of government standard for cryptographic modules so if you're using openssl to generate certificates or you have an application that's written and compiled with the openssl modules they are written to support this fips 140-2 standard and i believe over here it says they've submitted the request for approval but it hadn't been approved yet so they're still writing the fips 140-2 um approval uh here it is submit it for validation right there it says i submitted it there that was back in september and there is a fips 140.140-3 standard that was released recently also but they don't currently have anything that's approved for the dash 3 yet and when you go in and you're getting ready to do the configure that's not i want this whole configure command okay so it runs the configure command that i pasted in and when you add the enable fips option [Music] um there's no dash in front of it there's no dash dash in front of it it's just enable dash fips and i will do the same thing on the linux box not the linux the debian box so i'll dot slash configure tell it where the prefix tell it where the open ssl directory is and i'll hit enter that's because i'm not in the open ssl folder so when i do that command again it'll go through and it'll run the configuration script okay so we've run the configuration script on both the first thing we're going to do is type in the make command and let's see how long it takes on both of these i'm running time in front of make to tell me how long this command is going to take and i'm going to do the same thing down here now these boxes are actually two containers running on an ammo linux box let me get back on it come on all right i got two factor enabled on there i gotta type my code in watch my previous video on two-factor authentication so this is actually um uh alma linux virtual machine um running pod man and under podman i've got one container running alma linux and one container running debian i do that so i can install stuff test it and just wipe it all and not have to worry about it so you can see it's doing about 84 to 85 percent on the processor during the compile and we're going to let both of those go ahead and finish compiling and we'll come back after that the make is finished on both systems took about four minutes and three seconds on alma four minutes and one second on the debian box so the next command to run here which would be make test i'm going to time that also now you don't have to use the time command i just use it to see the different compile times between the two different systems now if you didn't have that module installed um what's it called if you didn't have the test colon colon mower module installed when you run this mate test it would fail with an error message even if the previous mate command was successful the test more module is needed to run to make tests and we're back from an exciting five minutes and 39 seconds and five minutes and 25 seconds running the make tests and you see that it passed on both systems all right so now that's all done we can actually do the install and we'll run the make install now the make install looks at the command line options that you use for the configure and we told it to put it in user local open ssl 3.0 again if you don't specify where you want to install it it install it's it installs in the default location that default is normally a slash opt and sometimes it's user local i was going to stop recording but that looks it looks neat on the uh on the obs window so i'll let it run and keep recording um i'll probably just slow it down all right the make install has finished and it gets down to the bottom and it says installing the fips module um you want to make note that it installed it there and same with the debian box it installed the fit tips module and it installed it there so let's use the alma box for example so if i go to the folder where i installed this you can see it created some directories the binaries are in bin the libraries are in lib64 there's the openssl configuration file so if i switch over into that bin directory into ls i can see i have a binary there called open ssl now it isn't ready yet if i try to run that with the full path or with the dot slash notation you get an error that it can't find the shared object file it's looking for some libraries it's looking for the libraries that are in this folder so what did it say up there at ssl.so.3 which is here and that's because the system does not know about these libraries since you are compiling them by hand so you have to let the system know how to get to these library files and this is the path that they're in so i'm going to copy that you go to etsy and there's a file there called ld.so.com and there's a single line in there that says include any files that end with conf from this directory so we're going to go into that directory you're already in etsy so let's go to ld.so.com and there's only one file in there and the format is just the folder that has the libraries that you want to add so we're going to create a file open ssl 3.0.com it has to end in.com and inside of that we're going to paste in the folder that has the library files for this openssl 3 that we just compiled which is here right quick which saves it now it's the configuration file is there you can reboot it and it'll pick up the change or you can just type ld config and it goes back through and reads all the new files and applies them so when i run ld config and i go back and to try to run that command again i have a full path in here somewhere yeah there's the full path to it but now when i run it it runs like normal and i tell it i want the version it tells me it's reading a 3.10 dead well it tells me about the compilers the platform stuff like that so basically it's ready to go and you do the same thing on the debian system you go to etsy they've got a few more files but you're doing the same thing you're creating a file for openssl name doesn't matter as long as it ends in comp paste it in that directory saving it running ld config after you make the save or reboot the system you run user local oh it's in get the same results so you can now start using the newer version of openssl and you can generate your certificates and csrs and all that stuff the same way you do with any version of openness as hell and if you've got other programs that you have to compile and you need the development files for openssl three you have them here those are the files that you downloaded now i just happen to put them in group but you can put them anywhere you want so now you've got all the downloaded development code and you can compile your other programs and use the development files from the newer openssl the new version of openssl is not that hard to compile they're just a few modules that are not listed in the documentation that you have to add once you add those in you have to tell your system about the new libraries that you just compiled thanks for watching go ahead and like and hit subscribe [Music] you

Channel: RandomTech

Views: 155

Keywords: compile openssl 3.0, compile openssl 3, compile openssl3, compile openssl 3.0 fips, compile openssl almalinux, compile openssl debian

Id: a0q1TPc7spA

Length: 32min 3sec (1923 seconds)

Published: Sun Oct 31 2021