I have server on Debian Jessie with OpenSSL 1.0.1t 3 May 2016.I wanted to update OpenSSL to 1.0.2 and set custom DH parameters .So I added backports to sources.list , and installed new OpenSSL version with apt-get -t jessie-backports install opensslAfter installation restarted Apache but on phpinfo I can see wrong OpenSSL header version:PHP Version 7.0.17-1~dotdeb+8.1OpenSSL Library Version OpenSSL 1.0.2k 26 Jan 2017OpenSSL Header Version  OpenSSL 1.0.1t 3 May 2016Openssl default config  /usr/lib/ssl/openssl.cnf How I can fix that?Edit - more info for Stephen KittSomething is wrong and header is my only clue.Apache:apachectl -VServer version: Apache/2.4.10 (Debian)Server built:   Feb 24 2017 18:40:28Server's Module Magic Number: 20120211:37Server loaded:  APR 1.5.1, APR-UTIL 1.5.4Compiled using: APR 1.5.1, APR-UTIL 1.5.4Architecture:   64-bitServer MPM:     prefork  threaded:     no    forked:     yes (variable process count)Server compiled with.... -D APR_HAS_SENDFILE -D APR_HAS_MMAP -D APR_HAVE_IPV6 (IPv4-mapped addresses enabled) -D APR_USE_SYSVSEM_SERIALIZE -D APR_USE_PTHREAD_SERIALIZE -D SINGLE_LISTEN_UNSERIALIZED_ACCEPT -D APR_HAS_OTHER_CHILD -D AP_HAVE_RELIABLE_PIPED_LOGS -D DYNAMIC_MODULE_LIMIT=256 -D HTTPD_ROOT=/etc/apache2 -D SUEXEC_BIN=/usr/lib/apache2/suexec -D DEFAULT_PIDLOG=/var/run/apache2.pid -D DEFAULT_SCOREBOARD=logs/apache_runtime_status -D DEFAULT_ERRORLOG=logs/error_log -D AP_TYPES_CONFIG_FILE=mime.types -D SERVER_CONFIG_FILE=apache2.confOpenSSLopenssl version -aOpenSSL 1.0.2k  26 Jan 2017built on: reproducible build, date unspecifiedplatform: debian-amd64options:  bn(64,64) rc4(16x,int) des(idx,cisc,16,int) blowfish(idx)compiler: gcc -I. -I.. -I../include  -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -Wl,-z,relro -Wa,--noexecstack -Wall -DMD32_REG_T=int -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASMOPENSSLDIR: /usr/lib/sslAfter adding DH params to ssl.conf I'm getting errorsSSLOpenSSLConfCmd DHParameters /etc/ssl/private/dhparams.pemApache restartservice apache2 restartJob for apache2.service failed. See 'systemctl status apache2.service' and 'journalctl -xn' for details.systemctl status apache2.service apache2.service - LSB: Apache2 web server   Loaded: loaded (/etc/init.d/apache2)  Drop-In: /lib/systemd/system/apache2.service.d           forking.conf   Active: failed (Result: exit-code) since wto 2017-03-28 16:25:26 CEST; 11s ago  Process: 43828 ExecStop=/etc/init.d/apache2 stop (code=exited, status=0/SUCCESS)  Process: 51393 ExecReload=/etc/init.d/apache2 reload (code=exited, status=0/SUCCESS)  Process: 43857 ExecStart=/etc/init.d/apache2 start (code=exited, status=1/FAILURE)mar 28 16:25:26 domain.com apache2[43857]: Starting web server: apache2 failed!mar 28 16:25:26 domain.com apache2[43857]: The apache2 configtest failed. ... (warning).mar 28 16:25:26 domain.com apache2[43857]: Output of config test was:mar 28 16:25:26 domain.com apache2[43857]: AH00526: Syntax error on line 54 of /etc/apache2/mods-enabled/ssl.conf:mar 28 16:25:26 domain.com apache2[43857]: Invalid command 'SSLOpenSSLConfCmd', perhaps misspelled or defined by a module not included in the server configurationmar 28 16:25:26 domain.com apache2[43857]: Action 'configtest' failed.mar 28 16:25:26 domain.com apache2[43857]: The Apache error log may have more information.mar 28 16:25:26 domain.com systemd[1]: apache2.service: control process exited, code=exited status=1mar 28 16:25:26 domain.com systemd[1]: Failed to start LSB: Apache2 web server.mar 28 16:25:26 domain.com systemd[1]: Unit apache2.service entered failed state.
Wrong OpenSSL header version after update from jessie backwards
linux;debian;php;openssl
The headers are provided by the libssl-dev package, so you can tryapt-get -t jessie-backports install libssl-dev(Incidentally, openssl is just the openssl command-line front-end; the OpenSSL library is in the libssl1.0.0 package.)However, I suspect the OpenSSL Header Version information is stored in the PHP module when its built, so upgrading OpenSSL wont change it. It doesnt matter anyway, upgrading the library is sufficient.SSLOpenSSLConfCmd is only available with httpd 2.4.8 and later if its compiled with the OpenSSL headers 1.0.2 or later. Thats one instance where the features cant be improved simply by upgrading the library; you need to upgrade the headers too and rebuild mod_ssl.