7 ms·
Nginx 1.15.9
- aorth 8y agoOh. So that's what they meant by "variables support" in the ssl directives. I didn't realize the significance of that change when I read the changelog earlier today.
- skrebbel 8y agoWhat is? Looks like the link goes to a changelog and nothing else.
- petercooper 8y agoThe original title for this item was "Nginx 1.15.9 adds support for dynamic certificate loading" which explains why this is interesting, but then someone edited it to the current less useful version ¯\_(ツ)_/¯ Noticed via https://hackernewstitles.netlify.com/ https://hackernewstitles.netlify.com/
- torvald 8y ago> Noticed via https://hackernewstitles.netlify.com/ https://hackernewstitles.netlify.com/ Of course that's a thing.
- zorpner 8y agoBear in mind: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_c... Note that using variables implies that a certificate will be loaded for each SSL handshake, and this may have a negative impact on performance. Still a great feature. About to significantly simplify a few complex deployments I'm running.
- chupasaurus 8y agoMostly likely the certificates will stay in filesystem's cache because of the number of reads, and memcpy of some pages isn't a huge deal unless you're having 100K+ active and short-lived sessions per nginx instance.
- ptman 8y agoParsing is probably slower than memcpy
- chupasaurus 8y agoFair enough, but the server parses only the private key which is already well structured in any encoding. I haven't checked myself, but I believe correctness checks are ran on the reloading of a configuration.
- uasm 8y agoThat's a strange disclaimer. There should've been a cache there.
- zaarn 8y agoYou have a cache, if you SIGHUP the nginx process it'll reload the config and certificates on disk. With a simple script it is possible to SIGHUP when the certificate file is changed on disk.
- scurvy 8y agoDoes nginx still halt the master process when you have more than 70k cert/key pairs and send it a hup?
- regecks 8y agoStrange and potentially busted, if that interpretation is correct. What if your ACME client is updating the certificate and private key when an nginx connection comes in? You can't atomically update both files, right? So nginx will potentially see a mismatched key and certificate? :\ I hope it's guarded by SIGHUP, like sibling comment suggests.
- subway 8y agoNifty. I've been using ssl_certificate_by_lua_block from the openresty nginx lua module to accomplish this.
- clon 8y agoI cannot find any any information on how this data is sanitized. /safe/path/$hostname.key $hostname = ../../etc/some/secret /safe/path/../../etc/some/secret.key
- vegardx 8y agoThat wouldn't be a valid hostname or Host-header, see https://tools.ietf.org/html/rfc952 https://tools.ietf.org/html/rfc952
- an_account_name 8y agoHost headers are transmitted after the ssl handshake.
- duncaen 8y agoSNI?
- an_account_name 8y agoI read through the codebase and can't assert that couldn't happen... wasn't sure if the ngx_http_ssl_certificate callback could be executed after a point where any of the client-controlled variables from [1] are defined. [1] - https://nginx.org/en/docs/http/ngx_http_ssl_module.html#variables https://nginx.org/en/docs/http/ngx_http_ssl_module.html#vari...
- magicnmonkey 8y agoWho needs Russian spyware engine X when we now have American Build High Performance Caddy where you can actually get prosecuted if you try to spy on your users without declaring it upfront! We shouldn't use why software coming out of Russia
- gregoriol 8y agoWhy are they still supporting Windows Vista?!
- chemodax 8y agoMost likely because of Windows Server 2008: they are almost the same.
- tinus_hn 8y agoIf there is a feature ‘for Windows Vista or newer’ that implies they support even older versions.
- pas 8y agoProbably that's the version that introduced the poll API. They developed it on Win10, then noticed oh it should work on Vista. Tested it [maybe] and put it in the changelog. (And probably they have nginxplus customers that need Vista support?)
- arcbyte 8y agoSo with poll() now available on Windows is nginx ready to drop the beta label for Windows? http://nginx.org/en/docs/windows.html http://nginx.org/en/docs/windows.html