Require openssl1 on sles11sp3 from Security Module

There is a severe problem with SSL certificate verification
described in #9549 which renders client communication
unusable. The OpenSSL 0.9.8j version in SLES11 is buggy
and does not allow to verify clients on the master,
nor does a manual openssl verification work.

We'll therefore switch to the openssl1 package provided
by the SLES 11 Security Module and link against their
working API in order to resolve the problem in clusters
and client setups.

fixes #9549

diff --git a/INSTALL.md b/INSTALL.md
index f13556e667384fcea69ddf7cad0b8a1d39707da0..bab773ad407e4bc26aaeee1dbb70d8ae05ac9a4b 100644 (file)
--- a/INSTALL.md
+++ b/INSTALL.md
@@ -21,7 +21,8 @@ parentheses):
 * cmake
 * GNU make (make)
 * C++ compiler (gcc-c++ >= 4.7 on RHEL/SUSE, build-essential on Debian, alternatively clang++)
-* OpenSSL library and header files (openssl-devel on RHEL, libssl-dev on Debian)
+* OpenSSL library and header files >= 0.9.8 (openssl-devel on RHEL, libopenssl1-devel on SLES11,
+libopenssl-devel on SLES11, libssl-dev on Debian)
 * Boost library and header files (boost-devel on RHEL, libboost-all-dev on Debian)
 * GNU bison (bison)
 * GNU flex (flex) >= 2.5.35

diff --git a/doc/2-getting-started.md b/doc/2-getting-started.md
index 2ec661b1b3b28bb49e66195fbd8520c0820efcd2..ffdedef37e2d80bddd651df90a8885d67b794d06 100644 (file)
--- a/doc/2-getting-started.md
+++ b/doc/2-getting-started.md
@@ -46,6 +46,11 @@ RHEL/CentOS:
     # curl -o /etc/yum.repos.d/ICINGA-release.repo http://packages.icinga.org/epel/ICINGA-release.repo
     # yum makecache
 
+The packages for RHEL/CentOS depend on other packages which are distributed
+as part of the [EPEL repository](http://fedoraproject.org/wiki/EPEL). Please
+make sure to enable this repository by following
+[these instructions](http://fedoraproject.org/wiki/EPEL#How_can_I_use_these_extra_packages.3F).
+
 Fedora:
 
     # rpm --import http://packages.icinga.org/icinga.key
@@ -57,6 +62,9 @@ SLES 11:
     # zypper ar http://packages.icinga.org/SUSE/ICINGA-release-11.repo
     # zypper ref
 
+The packages for SLES 11 depend on the `openssl1` package which is distributed
+as part of the [SLES 11 Security Module](https://www.suse.com/communities/conversations/introducing-the-suse-linux-enterprise-11-security-module/).
+
 SLES 12:
 
     # zypper ar http://packages.icinga.org/SUSE/ICINGA-release.repo
@@ -67,11 +75,6 @@ openSUSE:
     # zypper ar http://packages.icinga.org/openSUSE/ICINGA-release.repo
     # zypper ref
 
-The packages for RHEL/CentOS depend on other packages which are distributed
-as part of the [EPEL repository](http://fedoraproject.org/wiki/EPEL). Please
-make sure to enable this repository by following
-[these instructions](http://fedoraproject.org/wiki/EPEL#How_can_I_use_these_extra_packages.3F).
-
 ### <a id="installing-icinga2"></a> Installing Icinga 2
 
 You can install Icinga 2 by using your distribution's package manager

diff --git a/icinga2.spec b/icinga2.spec
index d378500ae64d35a508c8f533e82919f0464ace0e..b996138e88964ddee33212d6fb325d58d8c623c8 100644 (file)
--- a/icinga2.spec
+++ b/icinga2.spec
@@ -92,13 +92,14 @@ BuildRequires: libyajl-devel
 %endif
 BuildRequires: libedit-devel
 BuildRequires: ncurses-devel
-BuildRequires: openssl-devel
-%if "%{_vendor}" == "suse" && 0%{?suse_version} < 1310
+%if "%{_vendor}" == "suse" && 0%{?suse_version} < 1210
 BuildRequires: gcc47-c++
 BuildRequires: libstdc++47-devel
+BuildRequires: libopenssl1-devel
 %else
 BuildRequires: gcc-c++
 BuildRequires: libstdc++-devel
+BuildRequires: openssl-devel
 %endif
 BuildRequires: cmake
 BuildRequires: flex >= 2.5.35