Home / server / Questions / 699235
Accepted
sa289
Asked: 2015-06-16 13:50:22 +0800 CST

Apache 2.2 end of life

  • 772

Does anyone know when the end of life date will be for Apache 2.2.x? Judging from historical patterns, I'm guessing in 2016 or 2017 (both 1.3 and 2.0 were between 11 and 12 years, and 2.2 came out in 2005).

I was hoping to find something authoritative such as a planned end of life date or a minimum committed end of life date (i.e. the Apache Software Foundation guarantees it will be supported until at least 20##), but I couldn't find anything online other than what's happened historically.

See table on https://en.wikipedia.org/?title=Apache_HTTP_Server#Development for historical release and EOL dates.

apache-2.2

4 Answers

  1. Best Answer

    Apache is open source software, which means that is can be maintained by anyone interested in doing this.

    Also, Apache is a vital part of every Linux distributions, from which eg. RHEL / CentOS / Oracle Linux 6.x has Apache 2.2 and will be supported up to November 2020. And each distribution maintainers patch bugs in Apache (and other software packages) on their own.

    So, the date of REAL end of life for Apache 2.2 is unpredictable.

    • 10

  2. Although there is no official end-of-life for Apache 2.2, there are a few measures you can use to determine an appropriate transition time, namely:

    • Feature support (often via modules, e.g. modssl)
    • Adherence to current standards (e.g., TLSv1.2)
    • Availability (back-porting) of bug-fixes
    • Timeliness of security updates (e.g., logjam)

    From my perspective, several of these lines have been crossed in the past few years. Specifically, Apache 2.2 with modssl does not have a fix for the logjam vulnerability yet, but Apache 2.4 has had this for some time now.

    A few years ago, SNI support was slow to come to Apache 2.2 - it was an Apache 2.4 feature back-ported via an unofficial patch for a long time.

    I've been using Apache 2.2 for years, and only decided to begin making the transition to 2.4 a few months ago (one of our servers had an additional SSL requirement that only Apache 2.4 can currently satisfy) so we currently have some 2.2 servers, some 2.4. Ultimately I only want to support a single server stack. Your reasons may vary, but these were the important points for making my decision.

    • 9

  3. From http://www.apache.org/dist/httpd/Announcement2.4.html:

    Please note that Apache Web Server Project will only provide maintenance releases of the 2.2.x flavor through June of 2017, and will provide some security patches beyond this date through at least December of 2017. Minimal maintenance patches of 2.2.x are expected throughout this period, and users are strongly encouraged to promptly complete their transitions to the the 2.4.x flavor of httpd to benefit from a much larger assortment of minor security and bug fixes as well as new features.

    • 3

  4. The official end of life for Apache 2.2 was January 1, 2018 (see Apache home page):

    Apache httpd 2.2 End-of-Life 2018-01-01

    As previously announced, the Apache HTTP Server Project has discontinued all development and patch review of the 2.2.x series of releases.

    The Apache HTTP Server Project had long committed to provide maintenance releases of the 2.2.x flavor through June of 2017. The final release 2.2.34 was published in July 2017, and no further evaluation of bug reports or security risks will be considered or published for 2.2.x releases.

    The first official announcement was July 5, 2016.

    This is for all our 2.2 users, your time is running out.

    With today's announcement of Apache 2.4.23 the Apache Software Foundation included the timetable agreed upon last month for Apache 2.2's end-of-life (EOL).

    So Apache 2.2 will no longer receive any new releases after June 30, 2017. I would expect one last release at that time. Apache 2.2 will EOL completely on December 31, 2017 and there will not be any maintenance after that date.

    Some Background

    The developers of the Apache HTTP Server are almost entirely volunteers that devote some of their free time maintaining the software. Because of this, they are free to choose what they want to devote this time on and for most that is mainly maintaining the 2.4 code base, new features or enhancements as well as 2.6/3.0 or simply 2.next as I like to call it. This results in the problem that not enough developers either can or are willing to spend time reviewing bug fixes or release candidates of 2.2 and it takes 3 developers to review and OK any such changes or releases. So if you cannot get three people to review and vote, why bother with maintaining it at all?

    A good example of this is Apache 2.2.32 which was scheduled to be released at the same time as 2.4.23. There are two bug fixes that have been sitting there for awhile that need reviewing and given the OK to proceed but are still 1 vote short. This past weekend being a holiday weekend in the states didn't help matters any but with the holiday over and 2.4.23 out the door, this will hopefully happen in the next couple days for a release sometime next week.

    The first time a vote came up to EOL 2.2 was in May of 2015. This was postponed to November 2015 because at that time there was not a very good 2.4 adoption rate due to the fact that many maintained Linux versions/distros still included Apache 2.2 and would not get updated to 2.4. These versions/distros have finally gone EOL themselves but for a few. This postponed vote finally came last month and pre-vote polling of those willing to contribute to 2.2 chose the timetable.

    Looking at the results of that poll, I only see two developers willing to maintain/review bug/security fixes and two willing to test and vote for new releases out to June 2017, it looks as the rest are only willing to go to the end of this year so after that things may get sketchy if 3 votes cannot be obtained and basically EOLing 2.2 before the end 2017.

    • 0