8 ms·
Bear in mind: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_c... Note t
by zorpner 8y ago
Bear in mind: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_c...
Note that using variables implies that a certificate will be loaded for each SSL handshake, and this may have a negative impact on performance.
Still a great feature. About to significantly simplify a few complex deployments I'm running.
- chupasaurus 8y agoMostly likely the certificates will stay in filesystem's cache because of the number of reads, and memcpy of some pages isn't a huge deal unless you're having 100K+ active and short-lived sessions per nginx instance.
- ptman 8y agoParsing is probably slower than memcpy
- chupasaurus 8y agoFair enough, but the server parses only the private key which is already well structured in any encoding. I haven't checked myself, but I believe correctness checks are ran on the reloading of a configuration.
- uasm 8y agoThat's a strange disclaimer. There should've been a cache there.
- zaarn 8y agoYou have a cache, if you SIGHUP the nginx process it'll reload the config and certificates on disk. With a simple script it is possible to SIGHUP when the certificate file is changed on disk.
- scurvy 8y agoDoes nginx still halt the master process when you have more than 70k cert/key pairs and send it a hup?
- regecks 8y agoStrange and potentially busted, if that interpretation is correct. What if your ACME client is updating the certificate and private key when an nginx connection comes in? You can't atomically update both files, right? So nginx will potentially see a mismatched key and certificate? :\ I hope it's guarded by SIGHUP, like sibling comment suggests.
- ngrilly 8y agoGreat question.
- emersion 8y agoACME clients should write the private key and certificate to a temporary file, then move it to the final destination so that the change is atomic.
- spatz 8y agoThat would work for one file but there's no way to atomically rename two.
- regecks 8y agoI suppose you could do it if you placed them in a directory, and renamed that. But I don't think that's what Certbot does, I think it works by changing file symlinks individually.
- tinus_hn 8y agoThe actual problem is the other way around: you can’t open two files atomically.
- rubatuga 8y agoYou should only need to update the certificate not the private key
- scurvy 8y ago