SSL BoringSSL vs OpenSSL

BoringSSL is Google's forked version of OpenSSL cryptographic library and BoringSSL is used in all Google web site products' TLS stacks since June 2014 - including Google Android OS and Google Chrome. You can find Google's original BoringSSL introduction dating back to October, 2015 at ImperialViolet - BoringSSL. Latest Centmin Mod 123.09beta01's Nginx now supports BoringSSL crypto library along with LibreSSL and OpenSSL

---

As it relates to Nginx HTTPS, BoringSSL doesn't support OCSP stapling like OpenSSL. But there are other differences that you can read up on for BoringSSL & OCSP via following links

• OpenSSL - Wikipedia
  
• Make SSL boring again
• High-reliability OCSP stapling and why it matters
• Using OCSP Stapling to Improve Response Time and Privacy
• Revocation is broken (possible reason why Google BoringSSL removed OCSP stapling support?)

If folks have more info and/or links to other BoringSSL vs OpenSSL articles, please share them in this thread as well

 

Have you tested on slow 2G and slow 3G mobile connections the effects of no OCSP stapling yet on page load speeds ? That's where you probably will get 0.2s to 0.3s faster page loads which is quite a bit for target 2-3 seconds idea slow 3G pagespeed metric. But depends on speed of OCSP responding server run by SSL certificate provider Certificate Authority (CA) i.e. Letsencrypt OCSP servers.

FYI, Letsencrypt has one of the fastest OCSP servers around for CA providers running on Akamai network = OCSP sites ordered by failures. Sorted by speed Letsencrypt is around 8th fastest (minus first 6 failed ones) = OCSP sites ordered by average total http time

Top 20 fastest OCSP responders



Now that Centmin Mod Nginx has BoringSSL support working, I will be doing page load speed tests for such as well

 

True but depends on your visitor profile for connection type and geographic location and speed of SSL certificate provider's OCSP responding server and even web browser used.

For this forum my CruX (Chrome User Experience Report dashboard) shows majority of my connections are 4G. Though Google partially determines pagespeed metric for their search algorithm based on a 3G mobile profile speeds for your site.

 

Take letsencrypt OCSP responder metrics recorded by Netcraft over some select locations - look at the average but also max total responding times Performance Report for ocsp.int-x3.letsencrypt.org | Netcraft

US West/Azure based OCSP responding has average 0.040 seconds total response time but max of 5.628 seconds. Though most other listed locations have max of between 0.2 to 0.4 second total response time.



That would give you a rough idea of response times for similar connection speeds to OCSP responder for letsencrypt so quite fast. And like you said negligible for most folks.

 

Another item to consider is when using security feature for OCSP Must Staple if you want to further secure your site OCSP Must-Staple

Yes most sites won't need OCSP Must Staple though and don't use it anyway. Centmin Mod's Letsencrypt automation doesn't use OCSP Must Staple - though I plan to add optional support for it.

 

With Centmin Mod Nginx HTTPS vhost set

Code (Text):

ssl_prefer_server_ciphers   on;

Looks like even without specifying TLS 1.3 specific ssl_ciphers, BoringSSL will use TLS 1.3 ssl_ciphers out of the box. OpenSSL 1.1.1 doesn't seem to do that and require specifying TLS 1.3 ciphers in ssl_ciphers listing in Nginx HTTPS vhost.

 

True though only need patching with BoringSSL while OpenSSL won't need patching

To each their own choices

 

I mean if you want OCSP, no need to patch OpenSSL as it supported but need to patch for BoringSSL for OCSP.