Apache Friends Support Forum

Hi everyone:

I want to enable TLS1.3 for my server and I found out that it requires openSSL 1.1.1.

If I go to the latest download, and for 7.1.29 version, it says it includes openSSL 1.1.1, but after I install this version, it is not 1.1.1.

Is there any error or something I am not doing correctly?

Thanks for any help.

yhliu wrote:If I go to the latest download, and for 7.1.29 version,

The latest version on Xampp Download https://www.apachefriends.org/de/download.html is not 7.1.29 (thats the oldest), but 7.3.5 instead. I dont know if Bitnami accidently delivered a wrong module or a wrong description. I would try 7.3.5, maybe you will find openSSL 1.1.1 there.

Anyway, keep in mind, Xampp is NOT designed for productive servers and we do only support Xampp for local development.

Nobbie wrote:The latest version on Xampp Download https://www.apachefriends.org/de/download.html is not 7.1.29 (thats the oldest), but 7.3.5 instead.

Technically the Version branches of XAMPP 7.1.29 and 7.3.5 are of the same age. They only include different PHP versions. But PHP currently have three actively maintained minor version branches.

XAMPP 7.1.29 seems to have included OpenSSL 1.0.2r. I don't know if this is by accicent or not.
In the past XAMPP was based on the Apache binaries from ApacheLounge. This does not seem to be true any more because the current Apache 2.4.39 binaries from ApacheLounge truely included OpenSSL 1.1.1.

Nobbie wrote:

yhliu wrote:If I go to the latest download, and for 7.1.29 version,

The latest version on Xampp Download https://www.apachefriends.org/de/download.html is not 7.1.29 (thats the oldest), but 7.3.5 instead. I dont know if Bitnami accidently delivered a wrong module or a wrong description. I would try 7.3.5, maybe you will find openSSL 1.1.1 there.

Anyway, keep in mind, Xampp is NOT designed for productive servers and we do only support Xampp for local development.

Thank you for your reply. I can only use 7.1, because I need to use solr dll and it only supports 7.1 at the moment.
You also mentioned Xampp is not designed for productive servers, then how should I deploy or set up my servers after I use xampp for development? Any suggestions? Thanks.

Altrea wrote:

Nobbie wrote:The latest version on Xampp Download https://www.apachefriends.org/de/download.html is not 7.1.29 (thats the oldest), but 7.3.5 instead.

Technically the Version branches of XAMPP 7.1.29 and 7.3.5 are of the same age. They only include different PHP versions. But PHP currently have three actively maintained minor version branches.

XAMPP 7.1.29 seems to have included OpenSSL 1.0.2r. I don't know if this is by accicent or not.
In the past XAMPP was based on the Apache binaries from ApacheLounge. This does not seem to be true any more because the current Apache 2.4.39 binaries from ApacheLounge truely included OpenSSL 1.1.1.

OK, thank you.

Is it possible to submit a ticket to the development team to look into this?

I recommend in principle not to operate servers privately, but with a professional provider. This is not only easier, it is also better maintained (what do you do if you have a power failure during your absence?), but mostly cheaper, the cost of electricity alone is often higher than the cost of a hosted webspace.

yhliu wrote:Is it possible to submit a ticket to the development team to look into this?

I dont know, last not least i am only an User like you are. I am not from Bitnami neither an Apache developer.

According to the ApacheLounge's changelog, VC15 includes OpenSSL 1.1.1 and VC14 includes 1.0.2.

https://www.apachelounge.com/viewtopic.php?p=38016

Is there a specific reason to use the VC14 binaries instead of VC15?

PHP 7.1.x uses OpenSSL 1.0.2 so if the php is going to be loaded as an Apache module, Apache has to be using the same openssl version or big problems arise when the php_openssl.dll extension is also loaded, so it doesn't seem like a mistake. PHP 7.2 & 7.3 use openssl 1.1.1

Thanks for the explanation, that makes sense to me