Nginx Ding dong! - TLSv1.3 support in Nginx master branch

BamaStangGuy · Apr 26, 2017

1.13.0 is out today

eva2000 · Apr 26, 2017

BamaStangGuy said: ↑

1.13.0 is out today
Click to expand...

just a few hours late to the party https://community.centminmod.com/threads/nginx-announce-nginx-1-13-0.11483/#post-48818

eva2000 · May 6, 2017

More news Using TLS1.3 with OpenSSL — Open SSL Users

Hi all

OpenSSL 1.1.1, when it is released, will support TLSv1.3 and it will be
binary and source compatible with OpenSSL 1.1.0. If your application
already supports 1.1.0 then, in theory, all you need to do to support
TLSv1.3 is to drop in the new OpenSSL version. However there are various
issues that application developers and application deployers need to be
aware of. I have written a blog post to cover some of those things. You
can read it here:

Using TLS1.3 With OpenSSL - OpenSSL Blog

Matt
Click to expand...

Using TLS1.3 With OpenSSL - OpenSSL Blog

The forthcoming OpenSSL 1.1.1 release will include support for TLSv1.3. The new release will be binary and API compatible with OpenSSL 1.1.0. In theory, if your application supports OpenSSL 1.1.0, then all you need to do to upgrade is to drop in the new version of OpenSSL when it becomes available and you will automatically start being able to use TLSv1.3. However there are some issues that application developers and deployers need to be aware of. In this blog post I am going to cover some of those things.
Click to expand...

So OpenSSL 1.1.1 won't be released until TLS v1.3 spec is finalised

Current status of the TLSv1.3 standard
As of the time of writing TLSv1.3 is still in draft. Periodically a new version of the draft standard is published by the TLS Working Group. Implementations of the draft are required to identify the specific draft version that they are using. This means that implementations based on different draft versions do not interoperate with each other.

OpenSSL 1.1.1 will not be released until (at least) TLSv1.3 is finalised. In the meantime the OpenSSL git master branch contains our development TLSv1.3 code which can be used for testing purposes (i.e. it is not for production use). You can check which draft TLSv1.3 version is implemented in any particular OpenSSL checkout by examining the value of the TLS1_3_VERSION_DRAFT_TXT macro in the tls1.h header file. This macro will be removed when the final version of the standard is released.
Click to expand...

eva2000 · Oct 7, 2017

Interesting read of TLS 1.3 issues before [openssl-dev] Can I haz TLS 1.3 ?

Tests run by various companies, including Google, Mozilla, and Facebook, indicate that the “failure rate” of TLS 1.3 is disturbingly high. It appears that network hardware such as routers, gateways, load balancers and the like, are blocking TLS 1.3 packets because they don’t recognize the protocol. They are doing “fail closed” and block the connections because they don’t understand it, rather than assuming it’s safe to forward. The IETF often uses the term “middlebox” to describe such hardware that operates between endpoints, and this type of behavior that blocks new protocols as “ossificiation.” The various companies, and no doubt others, are trying experiments to tweak the protocol to lower the failure rate. For example, in some circumstances it might be acceptable to make a TLS 1.3 message look like a TLS 1.2 message (after you’ve already committed to doing TLS 1.3).

So far nobody has released any details. When it happens, it will be on the TLS-WG mailing list, which you can find at the page I referenced above. Until then, because of the draft differences, it’s impractical to run even limited deployment tests unless you’re willing to work with bleeding edge releases and undocumented flags. That’s unfortunate, and we all hope that the situation will be improved by the next IETF meeting in November. Until then, we just have to sit tight and wait.
Click to expand...

buik · Oct 7, 2017

No worry. Problems are made to be solved.

Log in / Register

Forums

Welcome to Centmin Mod Community

Nginx Ding dong! - TLSv1.3 support in Nginx master branch

BamaStangGuy Active Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

.

Log in / Register

Useful Searches

Welcome to Centmin Mod Community

Nginx Ding dong! - TLSv1.3 support in Nginx master branch

BamaStangGuy Active Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

.