Redhat7源码openssl编译为rpm并升级

注：为了安全，要备份旧版openssl相关文件

#迭代直接替换原有文件 – 如有需要建议备份以下文件
mkdir ~/ssl_bak
cp /usr/bin/openssl ~/ssl_bak
cp /usr/lib64/libcrypto.so.1.0.2k ~/ssl_bak
cp /usr/lib64/libssl.so.1.0.2k ~/ssl_bak

1. 下载openssl

[root@localhost ~]# wget https://www.openssl.org/source/old/1.1.1/openssl-1.1.1s.tar.gz

2. 安装相关依赖

[root@localhost ~]# yum -y install curl  which  make gcc perl  perl-WWW-Curl  rpm-build

注：centos/radhat6版本perl-WWW-Curl需要手动下载

[root@localhost ~]# wget http://mirrors.aliyun.com/centos-vault/6.10/os/x86_64/Packages/perl-WWW-Curl-4.09-4.el6.x86_64.rpm
[root@localhost ~]# rpm -ivh perl-WWW-Curl-4.09-4.el6.x86_64.rpm

3. 创建编译时所需要的目录

[root@localhost ~]# mkdir -p /root/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}

4. 手动编写openssl.spec文件

cat << 'EOF' > /root/rpmbuild/SPECS/openssl.spec
Summary: OpenSSL 1.1.1s for redhat
Name: openssl
Version: %{?version}%{!?version:1.1.1s}
Release: 1%{?dist}
Obsoletes: %{name} <= %{version}
Provides: %{name} = %{version}
URL: https://www.openssl.org/
License: GPLv2+

Source: https://www.openssl.org/source/%{name}-%{version}.tar.gz

BuildRequires: make gcc perl perl-WWW-Curl
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
%global openssldir /usr/local/newopenssl/openssl111i

%description
OpenSSL RPM for version 1.1.1s on redhat

%package devel
Summary: Development files for programs which will use the openssl library
Group: Development/Libraries
Requires: %{name} = %{version}-%{release}

%description devel
OpenSSL RPM for version 1.1.1s on redhat (development package)

%prep
%setup -q

%build
./config --prefix=%{openssldir} --openssldir=%{openssldir}
make -j4

%install
[ "%{buildroot}" != "/" ] && %{__rm} -rf %{buildroot}
%make_install

mkdir -p %{buildroot}%{_bindir}
mkdir -p %{buildroot}%{_libdir}
ln -sf %{openssldir}/lib/libssl.so.1.1 %{buildroot}%{_libdir}
ln -sf %{openssldir}/lib/libcrypto.so.1.1 %{buildroot}%{_libdir}
ln -sf %{openssldir}/bin/openssl %{buildroot}%{_bindir}

%clean
[ "%{buildroot}" != "/" ] && %{__rm} -rf %{buildroot}

%files
%{openssldir}
%defattr(-,root,root)
/usr/bin/openssl
/usr/lib64/libcrypto.so.1.1
/usr/lib64/libssl.so.1.1

%files devel
%{openssldir}/include/*
%defattr(-,root,root)

%post -p /sbin/ldconfig

%postun -p /sbin/ldconfig
EOF

5. 准备相应包并编译rpm包

[root@localhost ~]# cp openssl-1.1.1s.tar.gz /root/rpmbuild/SOURCES

cd /root/rpmbuild/SPECS && \
    rpmbuild \
    -D "version 1.1.1s" \
    -ba openssl.spec

6. 查看openssl的rpm包是否生成

[root@localhost SPECS]# cd /root/rpmbuild/RPMS/x86_64/
[root@localhost x86_64]# ls
openssl-1.1.1s-1.el6.x86_64.rpm  openssl-devel-1.1.1s-1.el6.x86_64.rpm

 7. 升级openssl到1.1.1s

[root@localhost x86_64]# rpm -ivh openssl-1.1.1s-1.el6.x86_64.rpm --force --nodeps

注意：

升级高版本openssl 切记有风险!

• 不可以提前卸载原openssl 例如: rpm -e openssl-1.0.2k-21.el7_9.x86_64
• 不可以直接升级openssl 1.1.1s 例如: rpm -Uvh openssl-1.1.1s-1.el6.x86_64.rpm 

不能直接删除软链接
如需使用新版本开发，则需替换原来的软链接指向，即替换原动态库，进行版本升级。
替换/lib(lib64)和/usr/lib(lib64)和/usr/local/lib(lib64)存在的相应动态库：

ln -sf /usr/local/openssl/lib/libssl.so.1.1 /usr/lib64/libssl.so
ln -sf /usr/local/openssl/lib/libcrypto.so.1.1 /usr/lib64/libcrypto.so