Все компилил в виртуальной машине, результаты в rpm-пакеты не помещал.
Необходимые для компиляции пакеты:
# yum install epel-release -y
# yum install file man mc p7zip tmux -y
# yum install cpp gcc gcc-c++ make libstdc++-devel pcre-devel zlib-devel -y
сборка OpenSSL 1.1.0g:
$ ./config \
enable-ec_nistp_64_gcc_128 \
no-deprecated \
no-filenames \
no-gost \
no-rc2 \
no-rc4 \
no-srp \
no-srtp \
no-ssl3 \
shared \
threads \
zlib-dynamic
$ make
# cp libcrypto.so.1.1 libssl.so.1.1 /usr/local/lib64
# cd /usr/local/lib64
# ln -s libcrypto.so.1.1 libcrypto.so
# ln -s libssl.so.1.1 libssl.so
# ldconfig /usr/local/lib64
# ldconfig -p
Для автоматического тестирования openssl 1.1.0g с помощью make test нужен Perl-модуль Test::More минимум 0.96, который идет с Perl v5.13.4.
# yum install patch
$ curl -L https://install.perlbrew.pl | bash
$ . ~/perl5/perlbrew/etc/bashrc
$ perlbrew available
$ perlbrew install perl-5.27.6
$ perlbrew list
$ perlbrew use perl-5.27.6
$ perl -v
$ perlbrew install-cpanm
$ cd ~/openssl-1.1.0g/
$ grep -r "/usr/bin/perl" ./
$ sed -i 's/\/usr\/bin\/perl/\/usr\/bin\/env perl/g' ./{Makefile,configdata.pm,test/recipes/80-test_cipherlist.t,test/README,Configurations/{unix-checker.pm,windows-checker.pm}}
$ make test
Сборка nginx 1.13.7
./configure \
--prefix=/usr/local/share/nginx \
--sbin-path=/usr/local/sbin/nginx \
--conf-path=/etc/nginx/nginx.conf \
--error-log-path=/var/log/nginx/error.log \
--pid-path=/var/run/nginx.pid \
--lock-path=/var/lock/subsys/nginx \
--user=nginx \
--group=nginx \
--with-threads \
--with-file-aio \
--http-log-path=/var/log/nginx/access.log \
--http-client-body-temp-path=/var/lib/nginx/tmp/client_body \
--http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi \
--http-proxy-temp-path=/var/lib/nginx/tmp/proxy \
--without-http_ssi_module \
--without-http_scgi_module \
--without-http_uwsgi_module \
--without-http_geo_module \
--without-http_split_clients_module \
--without-http_memcached_module \
--with-http_ssl_module \
--with-http_v2_module \
--with-http_realip_module \
--with-http_sub_module \
--with-http_auth_request_module \
--with-http_stub_status_module \
--with-http_gunzip_module \
--with-http_gzip_static_module \
--with-http_v2_module \
--with-cc-opt='-O2 -g -I ../openssl-OpenSSL_1_1_0g/include' \
--with-ld-opt="-L /usr/local/lib64" \
В файл /etc/nginx/conf.d/domain.ru.conf добавлены строки:
server {
server_name domain.ru;
listen 443 ssl http2;
ssl_certificate auth-acme/domain.ru.crt;
ssl_certificate_key auth-acme/domain.ru.key;
ssl_session_cache shared:SSLdsr:2m;
ssl_session_timeout 15m;
ssl_ciphers HIGH:!aNULL:!CAMELLIA:!DSS:!MD5:!PSK:!RC4:+AES128:+AES256:RSA+3DES:+SSLv3;
ssl_prefer_server_ciphers on;
ssl_ecdh_curve secp384r1;
add_header Strict-Transport-Security "max-age=15552000";
resolver 1.1.1.1 8.8.8.8 ipv6=off;
resolver_timeout 5s;
ssl_stapling on;
ssl_stapling_verify on;
location /.well-known/acme-challenge/ {
allow all;
default_type plain/text;
root /var/www/html/$server_name;
}
...
}
