Centos 5 - Zimbra requires openssl097a which causes Apache mod_ssl to segfault

[greenrenault]

We recently upgraded a Zimbra server to CentOS 5 which was also running an install of Apache + mod_ssl for some other web apps.

The Zimbra installation on the whole working fine. However, incoming emails were not being received. Instead this error was displayed in the log:

May  6 08:46:35 black postfix/smtpd[29745]: initializing the server-side TLS engine
May  6 08:46:35 black postfix/master[6655]: warning: process /opt/zimbra/postfix-2.2.9/libexec/smtpd pid 29745 killed by signal 11
May  6 08:46:35 black postfix/master[6655]: warning: /opt/zimbra/postfix-2.2.9/libexec/smtpd: bad command startup -- throttling

Installing the openssl 0.9.7a library solved this problem. But caused another...

This caused Apache + mod_ssl to segmentation fault on start up. Apache + mod_ssl requires openssl 0.9.8b (installed by default as the openssl package).

Having both libraries installed and creating symlinks for:
Zimbra - /lib/libssl.so.4 -> /lib/libssl.so.0.9.7a
Apache -/lib/libssl.so.6 -> /lib/libssl.so.0.9.8b

Does NOT work either and still causes Apache to seg fault on start up. It appears that Apache also uses the /lib/libssl.so.4 symlink. So having openssl 0.9.7a and openssl 0.9.8b installed together is creating a conflict.

It may be possible to point Zimbra to specifically the libssl.so.0.9.7a library and let Apache use openssl 0.9.8b however, I was not able to get this to work.

Anyone else encountered this problem? Or can suggest a possible solution? I would really love to hear it Otherwise, I'll just wait for Zimbra to be supported on RHEL5.

On another topic, I am seeing lots of these entries in the Zimbra log. What does this mean and is this another problem?

May  6 04:40:02 black slapd[7372]: <= bdb_equality_candidates: (zimbraMailStatus) index_param failed

Thanks!

[jholder]

Hi-
RHEL5/CentOS5 has some issues.
That's why it's taking us so long to get it out to our users. We actually tried to migrate our own server, and had issues of our own that we're working on.

My advice is to wait for the official build. Although we encourage users to experiment, I'm afraid that we won't know how the official upgrade script for 4.5.5 on CentOS/RHEL 5 will react with all of the modifications.

Wait. You'll be better in the end. Trust me.

john

[greenrenault]

Originally Posted by jholder

Hi-
RHEL5/CentOS5 has some issues.
That's why it's taking us so long to get it out to our users. We actually tried to migrate our own server, and had issues of our own that we're working on.

My advice is to wait for the official build. Although we encourage users to experiment, I'm afraid that we won't know how the official upgrade script for 4.5.5 on CentOS/RHEL 5 will react with all of the modifications.

Wait. You'll be better in the end. Trust me.

john

Thanks for the advice John. The SSL problem has been the biggest pain so far, everything else has worked (or worked with some minor attention).

This is our internal production email server, so Zimbra will be staying on RHEL5 and I am hoping that with the next point-release this issue will get resolved.

It things really turn to poo then we'll re-implement on RHEL4, but that's a lot of pain to go thru again.

[Grant]

A quick fix is to add /lib /usr/lib to the top of /etc/ld.so.conf.d/zimbra.conf to ensure the platform libraries are located first.

The problem seems to be that apache is resolving the ssl library at one of the zimbra library locations prior to the system library.