4 ms·

Right now, nginx 1.13.x requires compiling against OpenSSL 1.1.1 or newer to get TLSv1.3 supported in browsers. You need to compile the "draft-18" branch of Op

Right now, nginx 1.13.x requires compiling against OpenSSL 1.1.1 or newer to get TLSv1.3 supported in browsers. You need to compile the "draft-18" branch of OpenSSL as current browsers are on draft-18 (master is on draft-19).

newman314 10y ago
git clone https://github.com/openssl/openssl.git -b tls1.3-draft-18 openssl-1.1.1-tls1.3-draft-18
- voidz 10y ago
  Is this like, the fine print?
therealmarv 10y ago
that's the biggest weakness of nginx.... the whole compile stuff in a right way to get things/features really running there. And don't tell me it's easy to recompile nginx... you have to know a lot of nginx and switches to get the compiler setup well done.
- avar 10y ago
  Then don't write a compile-recipe from scratch, but take e.g. your distro's packaging script & just add the switch you need. This is easy and relatively fool-proof.
- Neil44 10y ago
  Apache is also a giant pain in the ass to get http2 support, you have to basically chuck out the distro packages and do everything from scratch (including OpenSSL) unless you're on a bleeding edge distro.
  - virtualwhys 10y ago
    Not to mention that http2 is buggy in 2.4.25 (fixes in 2.4.26 will be out in May). And yes, without a bleeding edge distro good luck. Building apache from source is not only very straightforward but a great way to maximimize httpd performance (all modules static, only include the modules you need). OpenSSL on the other hand, that's distro specific, and definitely more involved.
  - vbtechguy 9y ago
    at least RHEL/CentOS 7.4 will move to OpenSSL 1.0.2 for APLN and HTTP/2 support :)
- stefantalpalaru 10y ago
  > And don't tell me it's easy to recompile nginx... you have to know a lot of nginx and switches to get the compiler setup well done. Depends on your distro. On Gentoo, it's as simple as editing USE flags in /etc/portage/package.use and executing "emerge nginx".
- vbtechguy 9y ago
  or just script it to do all the leg work which is what I do with my LEMP installer for TLS v1.3 support and optional nginx compile against LibreSSL or OpenSSL or later BoringSSL https://community.centminmod.com/posts/48818/ https://community.centminmod.com/posts/48818/

newman314 10y ago

git clone https://github.com/openssl/openssl.git -b tls1.3-draft-18 openssl-1.1.1-tls1.3-draft-18

voidz 10y ago
Is this like, the fine print?

therealmarv 10y ago

that's the biggest weakness of nginx.... the whole compile stuff in a right way to get things/features really running there. And don't tell me it's easy to recompile nginx... you have to know a lot of nginx and switches to get the compiler setup well done.

avar 10y ago
Then don't write a compile-recipe from scratch, but take e.g. your distro's packaging script & just add the switch you need. This is easy and relatively fool-proof.
Neil44 10y ago
Apache is also a giant pain in the ass to get http2 support, you have to basically chuck out the distro packages and do everything from scratch (including OpenSSL) unless you're on a bleeding edge distro.
- virtualwhys 10y ago
  Not to mention that http2 is buggy in 2.4.25 (fixes in 2.4.26 will be out in May). And yes, without a bleeding edge distro good luck. Building apache from source is not only very straightforward but a great way to maximimize httpd performance (all modules static, only include the modules you need). OpenSSL on the other hand, that's distro specific, and definitely more involved.
- vbtechguy 9y ago
  at least RHEL/CentOS 7.4 will move to OpenSSL 1.0.2 for APLN and HTTP/2 support :)
stefantalpalaru 10y ago
> And don't tell me it's easy to recompile nginx... you have to know a lot of nginx and switches to get the compiler setup well done. Depends on your distro. On Gentoo, it's as simple as editing USE flags in /etc/portage/package.use and executing "emerge nginx".
vbtechguy 9y ago
or just script it to do all the leg work which is what I do with my LEMP installer for TLS v1.3 support and optional nginx compile against LibreSSL or OpenSSL or later BoringSSL https://community.centminmod.com/posts/48818/ https://community.centminmod.com/posts/48818/