Centmin Mod Nginx 1.11 + OpenSSL 1.1.0 Support Added

eva2000 · Aug 9, 2016

OpenSSL 1.1.0 Pre/Beta Patch Support for Nginx

Updated Centmin Mod 123.09beta01 branch, to add Nginx 1.11 patch to support early OpenSSL 1.1.0-pre6 testing. Details at OpenSSL - OpenSSL 1.1.0 is about to released. And OpenSSL 1.1.0 Release Notes. Final OpenSSL 1.1.0 release is slated for August 25th, 2016.

nginx -V
nginx version: nginx/1.11.3
built by clang 3.4.2 (tags/RELEASE_34/dot2-final)
built with OpenSSL 1.1.0-pre6 (beta) 4 Aug 2016
TLS SNI support enabled
configure arguments: --with-ld-opt='-ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/lib' --with-cc-opt='-m64 -mtune=native -mfpmath=sse -g -O3 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wno-sign-compare -Wno-string-plus-int -Wno-deprecated-declarations -Wno-unused-parameter -Wno-unused-const-variable -Wno-conditional-uninitialized -Wno-mismatched-tags -Wno-c++11-extensions -Wno-sometimes-uninitialized -Wno-parentheses-equality -Wno-tautological-compare -Wno-self-assign -Wno-deprecated-register -Wno-deprecated -Wno-invalid-source-encoding -Wno-pointer-sign -Wno-parentheses -Wno-enum-conversion -Wno-c++11-compat-deprecated-writable-strings -Wno-write-strings' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --with-http_stub_status_module --with-http_secure_link_module --with-openssl-opt=enable-tlsext --add-module=../nginx-module-vts --with-libatomic --with-threads --with-stream=dynamic --with-stream_ssl_module --with-http_gzip_static_module --with-http_sub_module --with-http_addition_module --with-http_image_filter_module=dynamic --with-http_geoip_module --with-stream_geoip_module --with-http_realip_module --add-dynamic-module=../ngx-fancyindex-0.4.0 --add-module=../ngx_cache_purge-2.3 --add-module=../ngx_devel_kit-0.3.0 --add-module=../set-misc-nginx-module-0.30 --add-module=../echo-nginx-module-0.59 --add-module=../redis2-nginx-module-0.13 --add-module=../ngx_http_redis-0.3.7 --add-module=../memc-nginx-module-0.17 --add-module=../srcache-nginx-module-0.31 --add-module=../headers-more-nginx-module-0.30 --with-pcre=../pcre-8.39 --with-pcre-jit --with-http_ssl_module --with-http_v2_module --with-openssl=../openssl-1.1.0-pre6
Click to expand...

Major changes between OpenSSL 1.0.2h and OpenSSL 1.1.0 [in pre-release]

Copyright text was shrunk to a boilerplate that points to the license

"shared" builds are now the default when possible

Added support for "pipelining"

Added the AFALG engine

New threading API implemented

Support for ChaCha20 and Poly1305 added to libcrypto and libssl

Support for extended master secret

CCM ciphersuites

Reworked test suite, now based on perl, Test::Harness and Test::More

*Most* libcrypto and libssl structures were made opaque including: <TBA>

libssl internal structures made opaque

SSLv2 support removed

Kerberos ciphersuite support removed

RC4 removed from DEFAULT ciphersuites in libssl

40 and 56 bit cipher support removed from libssl

All public header files moved to include/openssl, no more symlinking

SSL/TLS state machine, version negotiation and record layer rewritten

EC revision: now operations use new EC_KEY_METHOD.

Support for OCB mode added to libcrypto

Support for asynchronous crypto operations added to libcrypto and libssl

Deprecated interfaces can now be disabled at build time either relative to the latest release via the "no-deprecated" Configure argument, or via the "--api=1.1.0|1.0.0|0.9.8" option.

Application software can be compiled with -DOPENSSL_API_COMPAT=version to ensure that features deprecated in that version are not exposed.

Support for RFC6698/RFC7671 DANE TLSA peer authentication

Change of Configure to use --prefix as the main installation directory location rather than --openssldir. The latter becomes the directory for certs, private key and openssl.cnf exclusively.

Reworked BIO networking library, with full support for IPv6.

New "unified" build system

New security levels

Support for scrypt algorithm

Support for X25519

Extended SSL_CONF support using configuration files

KDF algorithm support. Implement TLS PRF as a KDF.

Support for Certificate Transparency

HKDF support.

Click to expand...

eva2000 · Aug 9, 2016

Added some quick OpenSSL vs LibreSSL benchmarks at SSL - OpenSSL 1.1.0-pre6 vs OpenSSL 1.0.2h vs OpenSSL 1.0.1e vs LibreSSL 2.4.2 vs LibreSSL 2.3.6 | Centmin Mod Community

Log in / Register

Forums

Join the community today

Centmin Mod Nginx 1.11 + OpenSSL 1.1.0 Support Added

eva2000 Administrator Staff Member

OpenSSL 1.1.0 Pre/Beta Patch Support for Nginx

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Join the community today

Centmin Mod Nginx 1.11 + OpenSSL 1.1.0 Support Added

eva2000 Administrator Staff Member

OpenSSL 1.1.0 Pre/Beta Patch Support for Nginx

eva2000 Administrator Staff Member

.