NGINX 1.18.0 stable собранный с Brotli, TLS 1.3 final (RFC 8446), OpenSSL 1.1.1g, поддержкой http2 для Red Hat Enterprise Linux и CentOS

ssl_protocols TLSv1.2 TLSv1.3;

NGINX 1.18.0 stable собранный с Brotli, TLS 1.3 final (RFC 8446), OpenSSL 1.1.1g, поддержкой http2 для Red Hat Enterprise Linux и CentOS: 3 комментария

1. Hello Alexander & all,

   as you might have noticed, today there has been a release of nginx-1.18.0 stable version.

   Since I have nginx repo somehow forgotten in my list, my webserver got upgraded via yum update and since that nginx stopped working. I fixed the configuration reflecting changes in nginx directives for version 1.18 and got it back functional. But only after I have done that, noted my website is no longer running TLS 1.3

   Having realized this, found out that official nginx repo contains a build compiled still against an ancient OpenSSL version:

   [root@server ~]# nginx -V
   nginx version: nginx/1.18.0
   built by gcc 4.8.5 20150623 (Red Hat 4.8.5-39) (GCC)
   built with OpenSSL 1.0.2k-fips 26 Jan 2017
   TLS SNI support enabled

   which is obviously the reason TLS 1.3 not working for me now.

   Will you be creating your CodeIT package built with OpenSSL 1.1.1d or later version for the new nginx anytime soon? I would not like to go back older nginx versions at this point since my configuration seems to work well enough, but it would be great to have your package from CodeIT repository instead.

   Thank you in advance,

   Daniel.

   Ответить

   1. Hello Daniel,

      Sure, we plan to build it with OpenSSL 1.1.1g soon. Need some time to investigate patches and test.

      Ответить

      1. Hello Alexander,

         great news. Yeah OpenSSL 1.1.1g version was also out yesterday, right..

         Do I have the right repository for RHEL7 where to expect it then? 🙂

         I have currently codeit.el7.repo :

         [CodeIT]
         name=CodeIT repo
         baseurl=https://repo.codeit.guru/packages/centos/7/$basearch
         enabled=1
         gpgkey=https://repo.codeit.guru/RPM-GPG-KEY-codeit
         gpgcheck=1

         Thank you,

         Daniel.

         Ответить