title: Apache reporting "Illegal protocol" when using TLSv1.3 with OpenSSL 1.1.1b installed
body: <p>I'm trying to test TLSv1.3 support and Apache is failing to start with the following output from <code>systemctl status httpd</code>...</p>
  
  <pre><code>systemd[1]: Starting The Apache HTTP Server...
  httpd[6001]: AH00526: Syntax error on line 100 of /etc/httpd/conf/httpd.conf:
  httpd[6001]: SSLProtocol: Illegal protocol 'TLSv1.3'
  systemd[1]: httpd.service: main process exited, code=exited, status=1/FAILURE
  systemd[1]: Failed to start The Apache HTTP Server.
  systemd[1]: Unit httpd.service entered failed state.
  systemd[1]: httpd.service failed.
  </code></pre>
  
  <p>I'm on EC2 and using Amazon Linux 2, which is limited to OpenSSL 1.0.2k, so I've manually downloaded and compiled OpenSSL 1.1.1b, and installed it in <strong>/usr/local/openssl/</strong> leaving the original intact.  To ensure the new one is used going forward I took the following steps...</p>
  
  <ol>
  <li><p>Created <strong>/etc/ld.so/conf.d/openssl.conf</strong> with <code>/usr/local/openssl/lib</code> as the content, then ran <code>ldconfig -v</code> to update it.</p></li>
  <li><p>Created <strong>/etc/profile.d/openssl.sh</strong> with the following content...</p>
  
  <pre><code>#Set OPENSSL_PATH
  OPENSSL_PATH="/usr/local/openssl/bin"
  export OPENSSL_PATH
  PATH=$PATH:$OPENSSL_PATH
  export PATH
  </code></pre>
  
  <p>... and ran <code>source /etc/profile.d/openssl.sh</code> to update it.</p></li>
  </ol>
  
  <p>I can confirm that <code>which openssl</code> is correctly pointing to <code>/usr/local/openssl/bin/openssl</code>, and that TLSv1.3 support is there using <code>/usr/local/openssl/bin/openssl ciphers -V -tls1_3 -s</code>...</p>
  
  <pre><code>0x13,0x02 - TLS_AES_256_GCM_SHA384  TLSv1.3 Kx=any      Au=any  Enc=AESGCM(256) Mac=AEAD
  0x13,0x03 - TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any      Au=any  Enc=CHACHA20/POLY1305(256) Mac=AEAD
  0x13,0x01 - TLS_AES_128_GCM_SHA256  TLSv1.3 Kx=any      Au=any  Enc=AESGCM(128) Mac=AEAD
  </code></pre>
  
  <p>Running <code>openssl version -a</code> produces the following...</p>
  
  <pre><code>OpenSSL 1.1.1b  26 Feb 2019
  built on: Wed May 15 15:07:48 2019 UTC
  platform: linux-x86_64
  options:  bn(64,64) rc4(16x,int) des(int) idea(int) blowfish(ptr)
  compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -O3 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPADLOCK_ASM -DPOLY1305_ASM -DZLIB -DNDEBUG
  OPENSSLDIR: "/usr/local/openssl"
  ENGINESDIR: "/usr/local/openssl/lib/engines-1.1"
  Seeding source: os-specific
  </code></pre>
  
  <p>I am currently using Apache v2.4.39 which is supposed to support TLSv1.3 and the SSL related directives in my <code>httpd.conf</code> are set up as follows:</p>
  
  <pre><code>### SSL CONFIGURATION
  
  # Session settings
  SSLSessionCache shmcb:/run/httpd/sslcache(512000)
  SSLSessionCacheTimeout 300
  SSLProtocol -all +TLSv1.3 +TLSv1.2
  SSLProxyProtocol -all +TLSv1.3 +TLSv1.2
  SSLCipherSuite    TLSv1.3   TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256
  SSLCipherSuite    SSL       ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256
  SSLHonorCipherOrder on
  SSLCompression off
  SSLSessionTickets off
  
  # OpenSSL Configuration Commands
  SSLOpenSSLConfCmd DHParameters /etc/ssl/dhparam.pem
  SSLOpenSSLConfCmd Curves X25519:secp521r1:secp384r1:prime256v1
  
  # Pseudo Random Number Generator (PRNG):
  SSLRandomSeed startup file:/dev/urandom  256
  SSLRandomSeed connect builtin
  
  # SSL Crypto Device
  SSLCryptoDevice builtin
  
  # HSTS / Header Strict Transport Security
  Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
  Header always set X-Frame-Options SAMEORIGIN
  Header always set X-Content-Type-Options nosniff
  
  # Online Certificate Status Protocol (OCSP) Stapling
  SSLUseStapling On
  SSLStaplingCache "shmcb:logs/ssl_stapling(32768)"
  </code></pre>
  
  <p>Finally, I tried removing Apache (via Yum) and reinstalling it (via Yum), but that seemed to have zero effect.  </p>
  
  <p>I'm still relatively new to compiling from source, so I'm just unsure of when it's required other than circumstances like we have with OpenSSL versions, so I'm not sure if the reason I'm hitting this wall is that I need to recompile httpd from source and manually target the new OpenSSL location or what?</p>
  
  <p>Any help would be greatly appreciated!</p>