Apache reporting "Illegal protocol" when using TLSv1.3 with OpenSSL 1.1.1b installed

Question

I'm trying to test TLSv1.3 support and Apache is failing to start with the following output from systemctl status httpd...

systemd[1]: Starting The Apache HTTP Server...
httpd[6001]: AH00526: Syntax error on line 100 of /etc/httpd/conf/httpd.conf:
httpd[6001]: SSLProtocol: Illegal protocol 'TLSv1.3'
systemd[1]: httpd.service: main process exited, code=exited, status=1/FAILURE
systemd[1]: Failed to start The Apache HTTP Server.
systemd[1]: Unit httpd.service entered failed state.
systemd[1]: httpd.service failed.

I'm on EC2 and using Amazon Linux 2, which is limited to OpenSSL 1.0.2k, so I've manually downloaded and compiled OpenSSL 1.1.1b, and installed it in /usr/local/openssl/ leaving the original intact. To ensure the new one is used going forward I took the following steps...

1. Created /etc/ld.so/conf.d/openssl.conf with /usr/local/openssl/lib as the content, then ran ldconfig -v to update it.

2. Created /etc/profile.d/openssl.sh with the following content...

   #Set OPENSSL_PATH
   OPENSSL_PATH="/usr/local/openssl/bin"
   export OPENSSL_PATH
   PATH=$PATH:$OPENSSL_PATH
   export PATH
   

   ... and ran source /etc/profile.d/openssl.sh to update it.

I can confirm that which openssl is correctly pointing to /usr/local/openssl/bin/openssl, and that TLSv1.3 support is there using /usr/local/openssl/bin/openssl ciphers -V -tls1_3 -s...

0x13,0x02 - TLS_AES_256_GCM_SHA384  TLSv1.3 Kx=any      Au=any  Enc=AESGCM(256) Mac=AEAD
0x13,0x03 - TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any      Au=any  Enc=CHACHA20/POLY1305(256) Mac=AEAD
0x13,0x01 - TLS_AES_128_GCM_SHA256  TLSv1.3 Kx=any      Au=any  Enc=AESGCM(128) Mac=AEAD

Running openssl version -a produces the following...

OpenSSL 1.1.1b  26 Feb 2019
built on: Wed May 15 15:07:48 2019 UTC
platform: linux-x86_64
options:  bn(64,64) rc4(16x,int) des(int) idea(int) blowfish(ptr)
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -O3 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPADLOCK_ASM -DPOLY1305_ASM -DZLIB -DNDEBUG
OPENSSLDIR: "/usr/local/openssl"
ENGINESDIR: "/usr/local/openssl/lib/engines-1.1"
Seeding source: os-specific

I am currently using Apache v2.4.39 which is supposed to support TLSv1.3 and the SSL related directives in my httpd.conf are set up as follows:

### SSL CONFIGURATION

# Session settings
SSLSessionCache shmcb:/run/httpd/sslcache(512000)
SSLSessionCacheTimeout 300
SSLProtocol -all +TLSv1.3 +TLSv1.2
SSLProxyProtocol -all +TLSv1.3 +TLSv1.2
SSLCipherSuite    TLSv1.3   TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256
SSLCipherSuite    SSL       ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256
SSLHonorCipherOrder on
SSLCompression off
SSLSessionTickets off

# OpenSSL Configuration Commands
SSLOpenSSLConfCmd DHParameters /etc/ssl/dhparam.pem
SSLOpenSSLConfCmd Curves X25519:secp521r1:secp384r1:prime256v1

# Pseudo Random Number Generator (PRNG):
SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin

# SSL Crypto Device
SSLCryptoDevice builtin

# HSTS / Header Strict Transport Security
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
Header always set X-Frame-Options SAMEORIGIN
Header always set X-Content-Type-Options nosniff

# Online Certificate Status Protocol (OCSP) Stapling
SSLUseStapling On
SSLStaplingCache "shmcb:logs/ssl_stapling(32768)"

Finally, I tried removing Apache (via Yum) and reinstalling it (via Yum), but that seemed to have zero effect.

I'm still relatively new to compiling from source, so I'm just unsure of when it's required other than circumstances like we have with OpenSSL versions, so I'm not sure if the reason I'm hitting this wall is that I need to recompile httpd from source and manually target the new OpenSSL location or what?

Any help would be greatly appreciated!

Answer 1

The Apache version you've installed is linked against the systems OpenSSL library, i.e. OpenSSL 1.0.2k. This library has no TLS 1.3 support which also means that the necessary functions needed to configure TLS 1.3 are not available and thus cannot be used from Apache.

This does not change if you just install TLS 1.3. First, Apache will continue to use the library installed in the original path. Even if you would replace this library Apache would not be able to use the TLS 1.3 specific function since it is not aware that these functions are available in the first place.

Instead Apache needs to be rebuild against the new OpenSSL version in order to be aware of the changes in the API and to use it. A simple remove and reinstall using yum will not cause such a rebuild, but will just reinstall the version linked against the systems OpenSSL version.