Featured Nginx Nginx 1.9.5 released with HTTP/2 support officially !

Nginx 1.9.5 with official HTTP/2 support is here http://nginx.org/en/CHANGES now. Centmin Mod Nginx is already HTTP/2 support ready and supported since Nginx 1.9.3. And Centmin Mod latest stable and beta branches have been updated to Nginx 1.9.5 default out of box

Code:

Changes with nginx 1.9.5                                         22 Sep 2015

    *) Feature: the ngx_http_v2_module (replaces ngx_http_spdy_module).
       Thanks to Dropbox and Automattic for sponsoring this work.

    *) Change: now the "output_buffers" directive uses two buffers by
       default.

    *) Change: now nginx limits subrequests recursion, not simultaneous
       subrequests.

    *) Change: now nginx checks the whole cache key when returning a
       response from cache.
       Thanks to Gena Makhomed and Sergey Brester.

    *) Bugfix: "header already sent" alerts might appear in logs when using
       cache; the bug had appeared in 1.7.5.

    *) Bugfix: "writev() failed (4: Interrupted system call)" errors might
       appear in logs when using CephFS and the "timer_resolution" directive
       on Linux.

    *) Bugfix: in invalid configurations handling.
       Thanks to Markus Linnala.

    *) Bugfix: a segmentation fault occurred in a worker process if the
       "sub_filter" directive was used at http level; the bug had appeared
       in 1.9.4.

---

 

For existing Centmin Mod users on Nginx 1.9.4 and lower, to update to Nginx 1.9.5 and take advantage of HTTP/2 need to update Centmin Mod code first as outlined at centminmod.com/upgrade.html via centmin.sh menu option 23 submenu option 1 and submenu option 2

Then once code updated, you can move on to updating to Nginx 1.9.5 for existing Centmin Mod LEMP stack users is easy via centmin.sh menu option 4. Just specify Nginx version number 1.9.5 when prompted. You can skip yum check if you know your system yum packages are up to date.

Code:

--------------------------------------------------------
Centmin Mod 1.2.3-eva2000.09 - http://centminmod.com
--------------------------------------------------------
                   Centmin Mod Menu           
--------------------------------------------------------
1).  Centmin Install
2).  Add Nginx vhost domain
3).  NSD setup domain name DNS
4).  Nginx Upgrade / Downgrade
5).  PHP Upgrade / Downgrade
6).  XCache Re-install
7).  APC Cache Re-install
8).  XCache Install
9).  APC Cache Install
10). Memcached Server Re-install
11). MariaDB 5.2/5.5 & 10.x Upgrade Sub-Menu
12). Zend OpCache Install/Re-install
13). Install ioping.sh vbtechsupport.com/1239/
14). SELinux disable
15). Install/Reinstall ImagicK PHP Extension
16). Change SSHD Port Number
17). Multi-thread compression: pigz,pbzip2,lbzip2...
18). Suhosin PHP Extension install
19). Install FFMPEG and FFMPEG PHP Extension
20). NSD Re-install
21). Update - Nginx + PHP-FPM + Siege
22). Add Wordpress Nginx vhost + WP Super Cache
23). Update Centmin Mod Code Base
24). Exit
--------------------------------------------------------
Enter option [ 1 - 24 ] 4
--------------------------------------------------------

Code:

Do you want to run YUM install checks ?  [y/n]

This will increase your upgrade duration time wise.
Check the change log centminmod.com/changelog.html
to see if any Nginx or PHP related new additions
which require checking YUM prequisites are met.
If no new additions made, you can skip the
YUM install check to speed up upgrade time.

[y/n]: n

Code:

**********************************************************************
* Nginx Update script - Included in Centmin Extras
* Version: 1.2.3-eva2000.09 - Date: 31/09/2015 - Copyright 2011-2015 CentminMod.com
**********************************************************************
This software comes with no warranty of any kind. You are free to use
it for both personal and commercial use as licensed under the GPL.
Nginx Upgrade - Would you like to continue? [y/n] y

Install which version of Nginx? (version i.e. 1.9.5}): 1.9.5

successful install near end should have something like this output

Code:

Tue Sep 22 15:35:39 UTC 2015
Success: Nginx was installed properly

/usr/local/nginx/conf/conf.d/demodomain.com.conf
---
/usr/local/nginx/conf/conf.d/newdomain.com.conf
---
/usr/local/nginx/conf/conf.d/newdomain.com.ssl.conf
26:  add_header Alternate-Protocol  443:npn-spdy/3;
30:  #spdy_headers_comp 5;
---
15:  listen 443 ssl http2;
26:  #add_header Alternate-Protocol  443:npn-spdy/3;
30:  ##spdy_headers_comp 5;
/usr/local/nginx/conf/conf.d/newdomain1.com.conf
---
/usr/local/nginx/conf/conf.d/newdomain1.com.ssl.conf
26:  add_header Alternate-Protocol  443:npn-spdy/3;
36:  #spdy_headers_comp 5;
---
15:  listen 443 ssl http2;
26:  #add_header Alternate-Protocol  443:npn-spdy/3;
36:  ##spdy_headers_comp 5;
/usr/local/nginx/conf/conf.d/newdomain2.com.conf
---
/usr/local/nginx/conf/conf.d/newdomain2.com.ssl.conf
26:  #add_header Alternate-Protocol  443:npn-spdy/3;
36:  #spdy_headers_comp 5;
---
15:  listen 443 ssl http2;
26:  ##add_header Alternate-Protocol  443:npn-spdy/3;
36:  ##spdy_headers_comp 5;
/usr/local/nginx/conf/conf.d/newdomain3.com.conf
---
/usr/local/nginx/conf/conf.d/newdomain3.com.ssl.conf
26:  #add_header Alternate-Protocol  443:npn-spdy/3;
36:  #spdy_headers_comp 5;
---
15:  listen 443 ssl http2;
26:  ##add_header Alternate-Protocol  443:npn-spdy/3;
36:  ##spdy_headers_comp 5;
/usr/local/nginx/conf/conf.d/ssl.conf
---
/usr/local/nginx/conf/conf.d/virtual.conf
---
Starting nginx:                                            [  OK  ]
*************************************************
* nginx updated
*************************************************

Then exit centmin.sh via menu option 24 and run nginx -V command to check for HTTP/2 module support via --with-http_v2_module

 

Let's test out HTTP/2 on a new Nginx vhost = newdomain4.com add the account either via centmin.sh menu option 2 or via /usr/bin/nv command line outlined at centminmod.com/nginx_domain_dns_setup.html

I used nv command line to create new Nginx vhost account = newdomain4.com with self-signed SSL certificate enabled = yes and pureftpd user ftp username set.

I used Centmin Mod 123.09beta01 which has added support for HTTP Public Key Pinning. Centmin Mod 123.08stable branch doesn't include HTTP Public Key Pinning.

Actual nv command line adding of newdomain4.com

Code:

nv -d newdomain4.com -s y -u http2userftp4

example output

Code:

nv -d newdomain4.com -s y -u http2userftp4
---------------------------------------------------------------
Nginx Vhost Setup...
---------------------------------------------------------------


FTP password auto generated: 62Ud1LWrqZsxZRyCxlWeN

Password:
Enter it again:
---------------------------------------------------------------
SSL Vhost Setup...
---------------------------------------------------------------

---------------------------------------------------------------
Generating self signed SSL certificate...
CSR file can also be used to be submitted for paid SSL certificates
If using for paid SSL certificates be sure to keep both private key and CSR safe
creating CSR File: newdomain4.com.csr
creating private key: newdomain4.com.key
creating self-signed SSL certificate: newdomain4.com.crt
Generating a 2048 bit RSA private key
.............................+++
...............................................................................+++
writing new private key to 'newdomain4.com.key'
-----
No value provided for Subject Attribute C, skipped
No value provided for Subject Attribute ST, skipped
No value provided for Subject Attribute L, skipped
Signature ok
subject=/O=newdomain4.com/OU=newdomain4.com/CN=newdomain4.com
Getting Private key

---------------------------------------------------------------
Generating backup CSR and private key for HTTP Public Key Pinning...
creating CSR File: newdomain4.com-backup.csr
creating private key: newdomain4.com-backup.key
Generating a 2048 bit RSA private key
......+++
..........................+++
writing new private key to 'newdomain4.com-backup.key'
-----
No value provided for Subject Attribute C, skipped
No value provided for Subject Attribute ST, skipped
No value provided for Subject Attribute L, skipped

Code:

---------------------------------------------------------------
Extracting Base64 encoded information for primary and secondary
private key's SPKI - Subject Public Key Information
Primary private key - newdomain4.com.key
Backup private key - newdomain4.com-backup.key
For HPKP - HTTP Public Key Pinning hash generation...

extracting SPKI Base64 encoded hash for primary private key = newdomain4.com.key ...
writing RSA key
5YsDgX42B3psx4I3q7O7nLJTHNEkDX2lKbEq5QAcix0=

extracting SPKI Base64 encoded hash for backup private key = newdomain4.com-backup.key ...
writing RSA key
pRT9A7pnjakHX5jO4lm/GuxWIr7EEo10/AsCiAgC+sU=

HTTP Public Key Pinning Header for Nginx

for 7 days max-age including subdomains

add_header Public-Key-Pins 'pin-sha256="5YsDgX42B3psx4I3q7O7nLJTHNEkDX2lKbEq5QAcix0="; pin-sha256="pRT9A7pnjakHX5jO4lm/GuxWIr7EEo10/AsCiAgC+sU="; max-age=86400; includeSubDomains';

for 7 days max-age excluding subdomains

add_header Public-Key-Pins 'pin-sha256="5YsDgX42B3psx4I3q7O7nLJTHNEkDX2lKbEq5QAcix0="; pin-sha256="pRT9A7pnjakHX5jO4lm/GuxWIr7EEo10/AsCiAgC+sU="; max-age=86400';

Code:

---------------------------------------------------------------
Generating dhparam.pem file - can take a few minutes...
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time
............++*
dhparam file generation time: 101.893498557

-------------------------------------------------------------
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
Stopping nginx:                                            [  OK  ]
Starting nginx:                                            [  OK  ]
service pure-ftpd restart

Code:

-------------------------------------------------------------
FTP hostname : serveripaddress
FTP port : 21
FTP mode : FTP (explicit SSL)
FTP Passive (PASV) : ensure is checked/enabled
FTP username created for newdomain4.com : http2userftp4
FTP password created for newdomain4.com : 62Ud1LWrqZsxZRyCxlWeN
-------------------------------------------------------------

Code:

vhost for newdomain4.com created successfully

domain: http://newdomain4.com
vhost conf file for newdomain4.com created: /usr/local/nginx/conf/conf.d/newdomain4.com.conf

vhost ssl for newdomain4.com created successfully

domain: https://newdomain4.com
vhost ssl conf file for newdomain4.com created: /usr/local/nginx/conf/conf.d/newdomain4.com.ssl.conf
/usr/local/nginx/conf/ssl_include.conf created
Self-signed SSL Certificate: /usr/local/nginx/conf/ssl/newdomain4.com/newdomain4.com.crt
SSL Private Key: /usr/local/nginx/conf/ssl/newdomain4.com/newdomain4.com.key
SSL CSR File: /usr/local/nginx/conf/ssl/newdomain4.com/newdomain4.com.csr
Backup SSL Private Key: /usr/local/nginx/conf/ssl/newdomain4.com/newdomain4.com-backup.key
Backup SSL CSR File: /usr/local/nginx/conf/ssl/newdomain4.com/newdomain4.com-backup.csr

upload files to /home/nginx/domains/newdomain4.com/public
vhost log files directory is /home/nginx/domains/newdomain4.com/log

Code:

-------------------------------------------------------------
Current vhost listing at: /usr/local/nginx/conf/conf.d/
                     
Sep 20  17:17   3.8K   newdomain1.com.ssl.conf-orig
Sep 20  17:21   460    newdomain1.com.ssl.conf-stream
Sep 22  15:35   1.1K   demodomain.com.conf
Sep 22  15:35   1.7K   newdomain.com.conf
Sep 22  15:35   3.4K   newdomain.com.ssl.conf
Sep 22  15:35   1.6K   newdomain1.com.conf
Sep 22  15:35   3.8K   newdomain1.com.ssl.conf
Sep 22  15:35   1.7K   newdomain2.com.conf
Sep 22  15:35   3.9K   newdomain2.com.ssl.conf
Sep 22  15:35   1.6K   newdomain3.com.conf
Sep 22  15:35   3.8K   newdomain3.com.ssl.conf
Sep 22  15:35   845    ssl.conf
Sep 22  15:35   1.6K   virtual.conf
Sep 22  15:45   1.6K   newdomain4.com.conf
Sep 22  15:45   3.8K   newdomain4.com.ssl.conf

Code:

-------------------------------------------------------------
Current vhost ssl files listing at: /usr/local/nginx/conf/ssl/newdomain4.com
                     
Sep 22  15:43   1.7K   newdomain4.com.key
Sep 22  15:43   964    newdomain4.com.csr
Sep 22  15:43   1.2K   newdomain4.com.crt
Sep 22  15:43   1.7K   newdomain4.com-backup.key
Sep 22  15:43   964    newdomain4.com-backup.csr
Sep 22  15:43   45     hpkp-info-primary-pin.txt
Sep 22  15:43   45     hpkp-info-secondary-pin.txt
Sep 22  15:45   424    dhparam.pem

Code:

-------------------------------------------------------------
Commands to remove newdomain4.com

rm -rf /usr/local/nginx/conf/conf.d/newdomain4.com.conf
rm -rf /usr/local/nginx/conf/conf.d/newdomain4.com.ssl.conf
rm -rf /usr/local/nginx/conf/ssl/newdomain4.com/newdomain4.com.crt
rm -rf /usr/local/nginx/conf/ssl/newdomain4.com/newdomain4.com.key
rm -rf /usr/local/nginx/conf/ssl/newdomain4.com/newdomain4.com.csr
rm -rf /usr/local/nginx/conf/ssl/newdomain4.com
rm -rf /home/nginx/domains/newdomain4.com
service nginx restart
-------------------------------------------------------------

contents of the HTTP/2 SSL nginx vhost file autogenerated at /usr/local/nginx/conf/conf.d/newdomain4.com.ssl.conf. Only Centmin Mod 123.09beta01 will have the HTTP Public Key Pinning sections which are disabled and commented out by default so you can choose to enable or not. You'd only enable if you use the auto generated self-signed SSL certificates CSR file and private key to order a paid SSL certificate which will have valid HTTP Public Key Pins. Otherwise, the generated HTTP Public Key Pins below would be of no use if you ordered a paid SSL certificate and used a new CSR file and private key other than one auto generated by Centmin Mod.

For more info on HTTP Public Key Pinning see centminmod.com/http-public-key-pinning.html. For Centmin Mod 123.08stable users you can ignore HTTP Public Key Pinning as it's not supported in that version yet.

/usr/local/nginx/conf/conf.d/newdomain4.com.ssl.conf contents

Code:

# Centmin Mod Getting Started Guide
# must read http://centminmod.com/getstarted.html
# For SPDY SSL Setup
# read http://centminmod.com/nginx_configure_https_ssl_spdy.html

# redirect from www to non-www  forced SSL
# uncomment, save file and restart Nginx to enable
# if unsure use return 302 before using return 301
# server {
#   server_name newdomain4.com www.newdomain4.com;
#    return 302 https://$server_name$request_uri;
# }

server {
  listen 443 ssl http2;
  server_name newdomain4.com www.newdomain4.com;

  ssl_dhparam /usr/local/nginx/conf/ssl/newdomain4.com/dhparam.pem;
  ssl_certificate      /usr/local/nginx/conf/ssl/newdomain4.com/newdomain4.com.crt;
  ssl_certificate_key  /usr/local/nginx/conf/ssl/newdomain4.com/newdomain4.com.key;
  include /usr/local/nginx/conf/ssl_include.conf;

  # mozilla recommended
  ssl_ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:!CAMELLIA;
  ssl_prefer_server_ciphers   on;
  #add_header Alternate-Protocol  443:npn-spdy/3;
  # HTTP Public Key Pinning Header uncomment only one that applies include or exclude domains.
  # You'd want to include subdomains if you're using SSL wildcard certificates
  # include subdomain
  #add_header Public-Key-Pins 'pin-sha256="5YsDgX42B3psx4I3q7O7nLJTHNEkDX2lKbEq5QAcix0="; pin-sha256="pRT9A7pnjakHX5jO4lm/GuxWIr7EEo10/AsCiAgC+sU="; max-age=86400; includeSubDomains';
  # exclude subdomains
  #add_header Public-Key-Pins 'pin-sha256="5YsDgX42B3psx4I3q7O7nLJTHNEkDX2lKbEq5QAcix0="; pin-sha256="pRT9A7pnjakHX5jO4lm/GuxWIr7EEo10/AsCiAgC+sU="; max-age=86400';
  #add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
  #add_header  X-Content-Type-Options "nosniff";
  #add_header X-Frame-Options DENY;
  #spdy_headers_comp 5;
  ssl_buffer_size 1400;
  ssl_session_tickets on;

  # enable ocsp stapling
  #resolver 8.8.8.8 8.8.4.4 valid=10m;
  #resolver_timeout 10s;
  #ssl_stapling on;
  #ssl_stapling_verify on;
  #ssl_trusted_certificate /usr/local/nginx/conf/ssl/newdomain4.com/newdomain4.com-trusted.crt;

# ngx_pagespeed & ngx_pagespeed handler
#include /usr/local/nginx/conf/pagespeed.conf;
#include /usr/local/nginx/conf/pagespeedhandler.conf;
#include /usr/local/nginx/conf/pagespeedstatslog.conf;

  # limit_conn limit_per_ip 16;
  # ssi  on;

  access_log /home/nginx/domains/newdomain4.com/log/access.log combined buffer=256k flush=60m;
  error_log /home/nginx/domains/newdomain4.com/log/error.log;

  root /home/nginx/domains/newdomain4.com/public;

  location / {

# block common exploits, sql injections etc
#include /usr/local/nginx/conf/block.conf;

  # Enables directory listings when index file not found
  #autoindex  on;

  # Shows file listing times as local time
  #autoindex_localtime on;

  # Enable for vBulletin usage WITHOUT vbSEO installed
  # More example Nginx vhost configurations at
  # http://centminmod.com/nginx_configure.html
  #try_files    $uri $uri/ /index.php;

  }

  include /usr/local/nginx/conf/staticfiles.conf;
  include /usr/local/nginx/conf/php.conf;
  include /usr/local/nginx/conf/drop.conf;
  #include /usr/local/nginx/conf/errorpage.conf;
  include /usr/local/nginx/conf/vts_server.conf;
}

 

doh.. slight boo boo

 

just updated all 13 servers in centminmod.com cluster + this forum + piwik analytics servers + sslspdy.com server all simultaneously to Nginx 1.9.5 with HTTP/2 support

doing the rest of my Centmin Mod LEMP stack powered servers in next batch

 

ah looks like http://wiki.nginx.org/images/5/51/Nginx-accesskey-2.0.3.tar.gz is a dead file now 404 it redirects to 'https://www.nginx.com/resources/wiki/

seems they have a new wiki section at https://www.nginx.com/resources/wiki/modules/

If using Centmin Mod .08 stable and higher, there's a preset included download files for base versions of software that Centmin Mod relies on and usually downloads that comes inside the download zip for Centmin Mod so if you're upgrading from Centmin Mod .07 and older, you can extract this from /downloads/svr-setup.zip to /svr-setup using this command in SSH as root user

Code:

/usr/bin/unzip -qo /usr/local/src/centminmod/downloads/svr-setup.zip -d /

if there any prompts for overwrite, you can select yes or A for ALL and your local /svr-setup download folder should have base software version downloads now for centmin.sh specified version downloads

Or you can just download the missing file from centminmod.com local mirror into /svr-setup directory

Code:

rm -rf /svr-setup/Nginx-accesskey-2.0.3.tar.gz
cd /svr-setup
wget -cnv http://centminmod.com/centminmodparts/nginx/modules/Nginx-accesskey-2.0.3.tar.gz

then re-run centmin.sh menu option 4

edit: also updated 123.08stable and 123.09beta01 with updated local Nginx-accesskey mirror download link update inc/downloadlinks.inc · centminmod/centminmod@c332113 · GitHub

 

probably caught github at a bad time heh

 

FYI you do not need to download whole zip file if you use recommended Centmin Mod update method via git centmin.sh menu option 2 centminmod.com/upgrade.html

only 2 files were updated at the time i did git update

Code:

remote: Counting objects: 15, done.
remote: Total 15 (delta 9), reused 9 (delta 9), pack-reused 6
Unpacking objects: 100% (15/15), done.
From https://github.com/centminmod/centminmod
   1614237..e421336  123.08stable -> origin/123.08stable
   c1318fe..ae742a9  123.09beta01 -> origin/123.09beta01
   f59f67e..8790380  master     -> origin/master
Updating c1318fe..ae742a9
Fast-forward
centmin.sh              |    2 +-
downloads/svr-setup.zip |  Bin 50967712 -> 50984141 bytes
2 files changed, 1 insertions(+), 1 deletions(-)

 

have to account for folks downgrading or updating to Nginx 1.9.3 or 1.9.4 which will automatically get Nginx HTTP/2 patch. Nginx 1.9.5 will automatically disable the actual patch application but delay is still in affect. I should fix that too

edit: adjusted adjust NGINXPATCH_DELAY variable · centminmod/centminmod@5ba264b · GitHub

 

ignore h2check it only looks for h2-15 draft spec protocol not the final h2 protocol see there top sites listing H2Check - usage share of the top ranking Alexa sites none list the final h2 spec all just drafts.

ssllabs SSL Server Test (Powered by Qualys SSL Labs) better or Chrome or web browser developer tools with protocol column checked

 

@Andy There are Chrome and Firefox extensions and plugins for HTTP/2 & SPDY Indicators you can install.

 

ah overlooked that still, it should take into account but doesn't right now. Will see about adding check for that too

edit: okay added code to both stable and beta branches to check for phpmyadmin.sh addon's auto generated ssl vhost and auto switch it between spdy and http2 supported directives and options update inc/nginx_upgrade.inc auto spdy to http2 routine check update · centminmod/centminmod@7771f2a · GitHub

 

Heads up if anyone uses Nginx Lua code in their vhosts (you'd be adding it yourself as Centmin Mod doesn't), then HTTP/2 isn't working 100% subrequests made via Nginx Lua ngx.location.capture() see subrequest error with http2