mod_ssl 2.8.31 PCI problem

[Tony Miller]

I'm having a PCI compliance issue regarding apache 2.2.22 and mod_ssl 2.8.31. My security vendor says there is an issue with mod_ssl 2.2.22, which is the current installed version. 

I've run the port upgrade outdated recently and retested, but it didn't change the mod_ssl version. Is there a special argument like port upgrade apache2+mod_ssl that I'm missing. 

port installed yields:

clipped .....
  apache2 @2.2.22_1+preforkmpm
  apache2 @2.2.22_2+preforkmpm (active)
  apr @1.4.2_1
clipped .....
  openssl @1.0.1b_0+rfc3779
  openssl @1.0.1c_0+rfc3779 (active)
  p5-locale-gettext @1.05_5
clipped .....

I've downloaded the source from http://www.modssl.org/source/mod_ssl-2.8.31-1.3.41.tar.gz, but am not that comfortable installing outside MacPorts yet.

This machine is in production so I can't experiment on it. I'm not that brave/stupid at this point. 

I don't see any tickets on this so thought I'd start here first. 

Thanks in advance

Tony Miller
tmiller at thehawkeye.com