# OpenSSL 3.0 on Rocky **URL:** \ **Category:** Rocky Linux Help & Support\ **Created:** [October 21, 2021, 11:57pm UTC](https://forums.rockylinux.org/t/openssl-3-0-on-rocky/4359 "2021-10-21T23:57:57Z")\ **Posts on this page:** 19\ **Page:** 1
**Author:** ![Endershot](https://avatars.discourse-cdn.com/v4/letter/e/e274bd/32.png) [@Endershot](https://forums.rockylinux.org/u/Endershot)\ **Post date:** [October 21, 2021, 11:57pm UTC](https://forums.rockylinux.org/t/openssl-3-0-on-rocky/4359/1 "2021-10-21T23:57:57Z")
I noticed that Rocky Linux is currently using OpenSSL v1.1.1, which was the most recent GA for OpenSSL until just recently. OpenSSL has now released OpenSSL v3.0. OpenSSL v1.1.1 does not support the FIPS object module that allows you to seek a FIPS certification on the OpenSSL implementation. OpenSSL v3.0 more or less integrates that FIPS module into the OpenSSL v3.0 release. We’d really like to be able to use Rocky Linux and still seek a FIPS 140-3 certification. What are the plans, if any, to move Rocky to OpenSSL v3.0? ---
**Author:** ![sweh](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/sweh/32/1287_2.png) [@sweh](https://forums.rockylinux.org/u/sweh)\ **Post date:** [October 22, 2021, 12:20am UTC](https://forums.rockylinux.org/t/openssl-3-0-on-rocky/4359/2 "2021-10-22T00:20:04Z")
Remember, Rocky 8 is just a rebuild of upstream RedHat 8. So the official version of OpenSSL will always be what RedHat provides in their distro. There may be additional repos that offer OpenSSL 3, but the core OS will always match RedHat. And since the whole point of RedHat Enterprise is to be consistent and since OpenSSL-3 has breaking compatibility changes to OpenSSL-1.1 I very very much doubt the core will change. ---
**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\ **Post date:** [October 22, 2021, 6:19am UTC](https://forums.rockylinux.org/t/openssl-3-0-on-rocky/4359/3 "2021-10-22T06:19:10Z")
One could ask: does RHEL 8 have FIPS 140-3? If yes, how? ---
**Author:** ![Endershot](https://avatars.discourse-cdn.com/v4/letter/e/e274bd/32.png) [@Endershot](https://forums.rockylinux.org/u/Endershot)\ **Post date:** [October 22, 2021, 11:26am UTC](https://forums.rockylinux.org/t/openssl-3-0-on-rocky/4359/4 "2021-10-22T11:26:40Z")
Good point @sweh . Rocky would move to OpenSSL 3.0 until Red Hat moves. So the real question is when will Red Hat move to v3.0. I guess I’ll go ask in a Red Hat forum. thanks! ---
**Author:** ![Endershot](https://avatars.discourse-cdn.com/v4/letter/e/e274bd/32.png) [@Endershot](https://forums.rockylinux.org/u/Endershot)\ **Post date:** [October 22, 2021, 11:30am UTC](https://forums.rockylinux.org/t/openssl-3-0-on-rocky/4359/5 "2021-10-22T11:30:50Z")
@jlehtone - I think it’s a little more complicated than that. RHEL 8’s implementation of OpenSSL does have a FIPS 140-2 certification, but it seems all the functionality to meet the FIPS requirements is added during the Red Hat build process so the source that is shared does not provide the FIPS object module functionality. I think this is one of the things you get when you pay for Red Hat’s built product. RHEL 8 FIPS: [Cryptographic Module Validation Program | CSRC](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3842) ---
**Author:** ![sweh](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/sweh/32/1287_2.png) [@sweh](https://forums.rockylinux.org/u/sweh)\ **Post date:** [October 22, 2021, 11:52am UTC](https://forums.rockylinux.org/t/openssl-3-0-on-rocky/4359/6 "2021-10-22T11:52:52Z")
My guess would be “not before RedHat 9”. ---
**Author:** ![rockyroad](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/rockyroad/32/2800_2.png) [@rockyroad](https://forums.rockylinux.org/u/rockyroad)\ **Post date:** [November 3, 2021, 8:41pm UTC](https://forums.rockylinux.org/t/openssl-3-0-on-rocky/4359/7 "2021-11-03T20:41:05Z")
Does anyone have information about updating OpenSSL from default 1.1.1g to 1.1.1k or 1.1.1l? I have found website instructions, but after trying on 5-6 different VM’s, amongst myself and coworker, whenever we reboot it doesnt come back up After following all instructions and typing ‘openssl version’, i confirm i successfully updated it to 1.1.1h or 1.1.1k, but as soon as i reboot, i come to a blank black screen with Rocky Linux on the bottom, but no username/password prompt ever appears. ---
**Author:** ![sweh](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/sweh/32/1287_2.png) [@sweh](https://forums.rockylinux.org/u/sweh)\ **Post date:** [November 3, 2021, 9:17pm UTC](https://forums.rockylinux.org/t/openssl-3-0-on-rocky/4359/8 "2021-11-03T21:17:26Z")
You shouldn’t replace OS provided libraries with alternate ones. Firstly it may not work, but even if it did then the next time there’s an OS patch for the package it’ll overwrite what you put there. So even if you got 1.1.1k today, tomorrow you might find 1.1.1g put back. Note that RedHat backport security patches without changing the release version. So RedHat’s 1.1.1g-15 should be fully patched. They also sometimes add functionality, if it’s not a breaking change. So looking at the changelog (`rpm -q --changelog openssl`) we can see: ```auto * Thu Mar 25 2021 Sahana Prasad 1.1.1g-15 - version bump * Wed Mar 24 2021 Sahana Prasad 1.1.1g-14 - CVE-2021-3450 openssl: CA certificate check bypass with X509_V_FLAG_X509_STRICT * Wed Mar 24 2021 Sahana Prasad 1.1.1g-13 - Fix CVE-2021-3449 NULL pointer deref in signature_algorithms processing * Fri Dec 04 2020 Sahana Prasad 1.1.1g-12 - Fix CVE-2020-1971 ediparty null pointer dereference * Mon Nov 02 2020 Tomáš Mráz 1.1.1g-11.1 - Implemented new FIPS requirements in regards to KDF and DH selftests - Disallow certificates with explicit EC parameters ``` ---
**Author:** ![jmcnally](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/jmcnally/32/1304_2.png) [@jmcnally](https://forums.rockylinux.org/u/jmcnally)\ **Post date:** [November 1, 2022, 6:21pm UTC](https://forums.rockylinux.org/t/openssl-3-0-on-rocky/4359/9 "2022-11-01T18:21:10Z")
Yes indeed: Rocky Linux 9.0 currently provides openssl version 3.0.1 from the BaseOS repo. Will the 3.0.7 update be available soon? The upstream release is supposed to drop today, Nov. 1. Thanks, -jm ---
**Author:** ![label](https://avatars.discourse-cdn.com/v4/letter/l/c5a1d2/32.png) [@label](https://forums.rockylinux.org/u/label)\ **Post date:** [November 1, 2022, 9:59pm UTC](https://forums.rockylinux.org/t/openssl-3-0-on-rocky/4359/10 "2022-11-01T21:59:45Z")
openssl 3.0.7 will not come to Rocky 9. 3.0.1 will be patched to version 3.0.1-43 and sent out for mirrors to sync. It is rare for Red Hat to rebase openssl to a newer release. Both CentOS Stream 9, RHEL 9, and Rocky Linux 9 will have 3.0.1-43 that revolves the two current CVE’s. ---
**Author:** ![abunn-r7](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/abunn-r7/32/2481_2.png) [@abunn-r7](https://forums.rockylinux.org/u/abunn-r7)\ **Post date:** [November 21, 2022, 3:15pm UTC](https://forums.rockylinux.org/t/openssl-3-0-on-rocky/4359/11 "2022-11-21T15:15:09Z")
@label Will there be an official Errata to announce the remediation of CVE-2022-3602 & CVE-2022-3786 in OpenSSL 3.0.1? ---
**Author:** ![label](https://avatars.discourse-cdn.com/v4/letter/l/c5a1d2/32.png) [@label](https://forums.rockylinux.org/u/label)\ **Post date:** [November 21, 2022, 4:10pm UTC](https://forums.rockylinux.org/t/openssl-3-0-on-rocky/4359/12 "2022-11-21T16:10:32Z")
Errata is not supported in Rocky Linux 9 repositories yet from peridot (the new build system). It may come sometime during 9.1. ---
**Author:** ![abunn-r7](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/abunn-r7/32/2481_2.png) [@abunn-r7](https://forums.rockylinux.org/u/abunn-r7)\ **Post date:** [November 21, 2022, 4:19pm UTC](https://forums.rockylinux.org/t/openssl-3-0-on-rocky/4359/13 "2022-11-21T16:19:15Z")
Until the Errata are supported by your backend build system, how should users find out which products are affected by vulnerabilities and which packages remediate the issues? ---
**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\ **Post date:** [November 21, 2022, 6:08pm UTC](https://forums.rockylinux.org/t/openssl-3-0-on-rocky/4359/14 "2022-11-21T18:08:50Z")
You can do what you always had todo with CentOS: run `dnf up` regularly. That gives you what exist. Run `rpm -q --changelog openssl` and you see what you have. Sort of. ---
**Author:** ![iwalker](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/iwalker/32/2599_2.png) [@iwalker](https://forums.rockylinux.org/u/iwalker)\ **Post date:** [November 21, 2022, 6:09pm UTC](https://forums.rockylinux.org/t/openssl-3-0-on-rocky/4359/15 "2022-11-21T18:09:00Z")
@abunn-r7 you can do something like this: ```auto [root@rocky9 ~]# dnf changelog openssl | grep -i cve - CVE-2022-3602: X.509 Email Address Buffer Overflow - running tests Resolves: CVE-2022-3602 - CVE-2022-3602: X.509 Email Address Buffer Overflow Resolves: CVE-2022-3602 - CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86 Resolves: CVE-2022-2097 - CVE-2022-2068: the c_rehash script allows command injection ``` gives you a list of what’s currently been addressed. So the first one you listed is on there. ---
**Author:** ![abunn-r7](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/abunn-r7/32/2481_2.png) [@abunn-r7](https://forums.rockylinux.org/u/abunn-r7)\ **Post date:** [November 21, 2022, 7:59pm UTC](https://forums.rockylinux.org/t/openssl-3-0-on-rocky/4359/16 "2022-11-21T19:59:03Z")
Thank you for your responses, however this does not solve the problem I am facing. This might work nicely for one or two machines running Rocky, but if I have a fleet of machines all with different packages and I need to ensure I am targeting the most severe vulnerabilities first, this approach is not useful. Not everyone can update everything all the time. Many companies have patching/maintenance windows and can only update one thing at a time to ensure compatibility between updates. By not publishing the Errata it makes it very difficult for a user to determine whether a vulnerability affects Rocky 9 or not. It’s pretty standard for operating systems with package managers to issue advisories for their products. Rocky does this for v8. Everyone else does this for every OS they ship. I would think this is a requirement for an enterprise-ready OS. ---
**Author:** ![neil](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/neil/32/34_2.png) [@neil](https://forums.rockylinux.org/u/neil)\ **Post date:** [November 21, 2022, 8:53pm UTC](https://forums.rockylinux.org/t/openssl-3-0-on-rocky/4359/17 "2022-11-21T20:53:40Z")
As Louis mentioned, Errata will be coming for 9.x sometime in 9.1. This is an _open source_, community supported operating system. As others have mentioned, Errata is something that never even existed for CentOS, so there are known ways to work around this. Moreover, most users won’t adopt a new OS within the first year of its release anyways, meaning there are not really ‘fleets of servers’ running 9.x yet–at least, not in the organizations I am involved with. We understand your issue, and it is being worked on, however these things aren’t just switches we flip on and off. It requires development work & time, QA work & time, and further time and energy to maintain long term for the community. Take it from me–we don’t maintain these features for us, but because they are asked for by the community. A small amount of patience is all that is asked in return. ---
**Author:** ![abunn-r7](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/abunn-r7/32/2481_2.png) [@abunn-r7](https://forums.rockylinux.org/u/abunn-r7)\ **Post date:** [November 21, 2022, 9:53pm UTC](https://forums.rockylinux.org/t/openssl-3-0-on-rocky/4359/18 "2022-11-21T21:53:34Z")
Thanks @neil for the background info! This context helps to paint the bigger picture. I truly do understand that the open-source community that drives Rocky is full of people donating their time and efforts, and that things like documentation are often the lowest effort-to-value items in any project. If the security errata process is an area that needs attention, how can I get involved in helping out? ---
**Author:** ![label](https://avatars.discourse-cdn.com/v4/letter/l/c5a1d2/32.png) [@label](https://forums.rockylinux.org/u/label)\ **Post date:** [August 24, 2023, 4:53am UTC](https://forums.rockylinux.org/t/openssl-3-0-on-rocky/4359/19 "2023-08-24T04:53:32Z")