Security WebPerf Akamai Sponsors OpenSSL TLS 1.3 Development

Akamai is sponsoring OpenSSL TLS 1.3 development with first OpenSSL TLS 1.3 release coming much earlier than I expected on April 5, 2017 with OpenSSL 1.1.0 branch (instead of talked about OpenSSL 1.1.1 branch). Full details https://blogs.akamai.com/2017/01/tls-13-ftw.html. Centmin Mod 123.09beta01 branch supports OpenSSL 1.1 branch so that means once OpenSSL 1.1.0 with TLS 1.3 is released, Centmin Mod Nginx HTTP/2 based HTTPS sites will also have TLS 1.3 support

More info on TLS 1.3 at https://community.centminmod.com/th...-by-the-cloudflare-crypto-team-at-33c3.10329/

---

 

Centmin Mod 123.09beta01's Nginx 1.11.10 + OpenSSL 1.1.0e as per https://centminmod.com/nginx.html#http2

set in persistent config file /etc/centminmod/custom_config.inc prior to Nginx recompiles using centmin.sh menu option 4

Code (Text):

LIBRESSL_SWITCH='n' # and set override LibreSSL defaults
OPENSSL_VERSION='1.1.0e' # override default 1.0.2k

 

AFAIK, Cloudflare will talk to your origin backend server in HTTP 1.1 protocol even for HTTPS full strict setups. Only Client to Cloudflare end is communicated in HTTP/2 HTTPS TLS 1.0, 1.1, 1.2 and 1.3.

 

HTTPS can be over faster HTTP/2 or slower HTTP 1.1.

So yes if you use Cloudflare SSL Full or Strict certificate setups, Cloudflare talks to client's origin backend servers via slower HTTP 1.1 based HTTPS

 

~4-5 days to go for TLS 1.3 supported OpenSSL 1.1.0 release I hope

 

Yeah saw that as well [openssl-dev] TLSv1.3 draft 19 support

 

Darn so it will be some time then at least developments are happening sooner rather than later

 

Yeah Nginx has voiced that before when OpenSSL 1.1.0 was in development - ever changing code so waited till final release

 

Bit of playtime with draft 18 TLSv1.3

Code (Text):

openssl ciphers -V "ALL:COMPLEMENTOFALL" | grep TLSv1.3
          0x13,0x02 - TLS13-AES-256-GCM-SHA384 TLSv1.3 Kx=any      Au=any  Enc=AESGCM(256) Mac=AEAD
          0x13,0x03 - TLS13-CHACHA20-POLY1305-SHA256 TLSv1.3 Kx=any      Au=any  Enc=CHACHA20/POLY1305(256) Mac=AEAD
          0x13,0x01 - TLS13-AES-128-GCM-SHA256 TLSv1.3 Kx=any      Au=any  Enc=AESGCM(128) Mac=AEAD
          0x13,0x05 - TLS13-AES-128-CCM-8-SHA256 TLSv1.3 Kx=any      Au=any  Enc=AESCCM8(128) Mac=AEAD
          0x13,0x04 - TLS13-AES-128-CCM-SHA256 TLSv1.3 Kx=any      Au=any  Enc=AESCCM(128) Mac=AEAD

 

no no TLS v1.3 isn't available in production on OpenSSL 1.1.0 branch yet it's still in developmental branches at OpenSSL so I am only testing it privately myself.

this thread is just discussing and tracking TLS v1.3's progress and eventual release

 

who knows.. right now 1.11.13 + openssl 1.1.0 with TLSv1.3 draft 18 doesn't compile cleanly as you said, Nginx side hasn't and probably won't look at it until final spec is determined.

Code (Text):

cd ../openssl-tls1.3 \
&& if [ -f Makefile ]; then make clean; fi \
&& ./config --prefix=/svr-setup/nginx-1.11.13/../openssl-tls1.3/.openssl no-shared  \
&& make \
&& make install_sw LIBDIR=lib
Operating system: x86_64-whatever-linux2
Global symbol "$chapoly_obj" requires explicit package name at ./Configure line 1302.
Global symbol "$cflags" requires explicit package name at ./Configure line 1304.
BEGIN not safe after errors--compilation aborted at ./Configure line 1343.
Global symbol "$chapoly_obj" requires explicit package name at ./Configure line 1302.
Global symbol "$cflags" requires explicit package name at ./Configure line 1304.
BEGIN not safe after errors--compilation aborted at ./Configure line 1343.
This system (linux-x86_64) is not supported. See file INSTALL for details.
make[1]: *** [../openssl-tls1.3/.openssl/include/openssl/ssl.h] Error 1
make[1]: Leaving directory `/svr-setup/nginx-1.11.13'
make: *** [build] Error 2