Hello Support team, I recently download the FR packages from your CentOS 7 repository, and I noticed that the 3.0.26 server was built with OpenSSL 1.0.2k (see below). Should the server be built with OpenSSL 1.1.1 to support TLS 1.3? Please excuse my ignorance if I've asked a stupid question. Thanks, Chris Howley Mon Jan 23 13:50:17 2023 : Debug: Server was built with: Mon Jan 23 13:50:17 2023 : Debug: accounting : yes Mon Jan 23 13:50:17 2023 : Debug: authentication : yes Mon Jan 23 13:50:17 2023 : Debug: ascend-binary-attributes : yes Mon Jan 23 13:50:17 2023 : Debug: coa : yes Mon Jan 23 13:50:17 2023 : Debug: control-socket : yes Mon Jan 23 13:50:17 2023 : Debug: detail : yes Mon Jan 23 13:50:17 2023 : Debug: dhcp : yes Mon Jan 23 13:50:17 2023 : Debug: dynamic-clients : yes Mon Jan 23 13:50:17 2023 : Debug: osfc2 : no Mon Jan 23 13:50:17 2023 : Debug: proxy : yes Mon Jan 23 13:50:17 2023 : Debug: regex-pcre : yes Mon Jan 23 13:50:17 2023 : Debug: regex-posix : no Mon Jan 23 13:50:17 2023 : Debug: regex-posix-extended : no Mon Jan 23 13:50:17 2023 : Debug: session-management : yes Mon Jan 23 13:50:17 2023 : Debug: stats : yes Mon Jan 23 13:50:17 2023 : Debug: systemd : yes Mon Jan 23 13:50:17 2023 : Debug: tcp : yes Mon Jan 23 13:50:17 2023 : Debug: threads : yes Mon Jan 23 13:50:17 2023 : Debug: tls : yes Mon Jan 23 13:50:17 2023 : Debug: unlang : yes Mon Jan 23 13:50:17 2023 : Debug: vmps : yes Mon Jan 23 13:50:17 2023 : Debug: developer : no Mon Jan 23 13:50:17 2023 : Debug: Server core libs: Mon Jan 23 13:50:17 2023 : Debug: freeradius-server : 3.0.26 Mon Jan 23 13:50:17 2023 : Debug: talloc : 2.1.* Mon Jan 23 13:50:17 2023 : Debug: ssl : 1.0.2k release Mon Jan 23 13:50:17 2023 : Debug: pcre : 8.32 2012-11-30 Mon Jan 23 13:50:17 2023 : Debug: Endianness: Mon Jan 23 13:50:17 2023 : Debug: little Mon Jan 23 13:50:17 2023 : Debug: Compilation flags: Mon Jan 23 13:50:17 2023 : Debug: cppflags : Mon Jan 23 13:50:17 2023 : Debug: cflags : -I. -Isrc -include src/freeradius-devel/autoconf.h -include src/freeradius-devel/build.h -include src/freeradius-devel/featur es.h -include src/freeradius-devel/radpaths.h -fno-strict-aliasing -Wno-date-time -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=s sp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -Wall -std=c99 -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -DNDEBUG -DIS_MODULE=1 Mon Jan 23 13:50:17 2023 : Debug: ldflags : -Wl,--build-id Mon Jan 23 13:50:17 2023 : Debug: libs : -lcrypto -lssl -ltalloc -lpcre -lnsl -lresolv -ldl -lpthread -lreadline Mon Jan 23 13:50:17 2023 : Debug: Mon Jan 23 13:50:17 2023 : Info: FreeRADIUS Version 3.0.26
On Jan 23, 2023, at 9:18 AM, Chris Howley <C.P.Howley@leeds.ac.uk> wrote:
I recently download the FR packages from your CentOS 7 repository, and I noticed that the 3.0.26 server was built with OpenSSL 1.0.2k (see below).
So far as I know, that's the version of OpenSSL which is included with CentOS7.
Should the server be built with OpenSSL 1.1.1 to support TLS 1.3?
Not really. CentOS 7 was released in 2014. That's a very long time ago. I'd suggest upgrading to a more recent distribution. Which will then include OpenSSL 3, and therefore also TLS 1.3. Alan DeKok.
participants (2)
-
Alan DeKok -
Chris Howley