Rather outdated OpenSSL library

Againcelow

Hello guys,

Not sure if this is an actual issue or not, but this seems to bother me:
When I run OpenVPN (which is version 2.3.6 on my Pi 2) it shows library version of OpenSSL only being 1.0.1e (11 Feb 2013), which is afaik affacted by the heartbleed bug?
When I run

openssl version

I get:
OpenSSL 1.0.2 22 Jan 2015
Which I installed before OpenVPN, so why is it not using this library but it's own instead?

Thanks in advance,
Againcelow

Traffic

Your upstream distro may not be upto date.

Please see this page for OpenVPN intructions:
https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos

Note:

The site certificate has expired and so you may not be able to complete this currently.
The administrators of the site have been informed and so (hopefully) this should be resolved very soon.

Againcelow

I'm indeed stuck on the very first command, so is this the only fix or is there another workaround?
This is the error:
ERROR: The certificate of `swupdate.openvpn.net' is not trusted.
The certificate has expired
gpg: no valid OpenPGP data found.

Thanks in advance,
Againcelow.

Againcelow

Hello guys,

I actually fixed this by using custom options during configure stage, I'll write down my full steps below:
First I did a basic

apt-get install openvpn

and all the other packages (lzo, libssl, ...) (also got easy-rsa from GitHub)
Then I downloaded the source files (.tar.gz) of both OpenVPN and OpenSSL using wget (this is located in /usr/src for me):

wget https://www.openssl.org/source/openssl-1.0.2.tar.gz
wget http://swupdate.openvpn.org/community/releases/openvpn-2.3.6.tar.gz

First I ./config & make & make install for OpenSSL.
After that was done, I ran the following ./configure options for OpenVPN:

./configure --enable-password-save OPENSSL_SSL_LIBS="-L/usr/src/openssl-1.0.2/ -lssl" OPENSSL_SSL_CFLAGS="-I/usr/src/openssl-1.0.2/include/" OPENSSL_CRYPTO_LIBS="-L/usr/src/openssl-1.0.2/ -lcrypto" OPENSSL_CRYPTO_CFLAGS="-I/usr/src/openssl-1.0.2/include/"

After this was done, I edited the file /etc/init.d/openvpn and made a change to redirect the location of the daemon in order to use my compiled OpenVPN daemon:

DAEMON=/usr/sbin/openvpn
TO
DAEMON=/usr/local/sbin/openvpn

After this, I ran my server again with the following output:

library versions: OpenSSL 1.0.2 22 Jan 2015, LZO 2.06

And that was it.

Please not I'm using Debian 7.x on Raspberry Pi 2, so I'm not sure how this would work out on other systems.

Againcelow