Nginx Nginx - No longer needed workaround for BoringSSL

Guess i should read the nginx master commits more closely http://hg.nginx.org/nginx/rev/ba971deb4b44 new directive = ssl_early_data on

---

 

Ok so with Centmin Mod Nginx 1.15.3 + BoringSSL with TLS 1.3 0-RTT early data enabled via = ssl_early_data on directive testing early data resumption (0-RTT)

from boringssl bssl binary help file

Code (Text):

-test-resumption        Connect to the server twice. The first connection is closed once a session is established. The second connection offers it.

-early-data     Enable early data. The argument to this flag is the early data to send or if it starts with '@', the file to read from for early data

look for Early data: yes

Code (Text):

/opt/boringssl/build/tool/bssl client -connect domain.com:443 -test-resumption -early-data /tmp/https.txt               
Connecting to IPADDR:443
Connected.
  Version: TLSv1.3
  Resumed session: no
  Cipher: TLS_AES_128_GCM_SHA256
  ECDHE curve: X25519
  Signature algorithm: ecdsa_secp256r1_sha256
  Secure renegotiation: yes
  Extended master secret: yes
  Next protocol negotiated:
  ALPN protocol:
  OCSP staple: no
  SCT list: no
  Early data: no
  Cert subject: CN = domain.com
  Cert issuer: C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
Connecting to IPADDR:443
Connected.
  Version: TLSv1.3
  Resumed session: yes
  Cipher: TLS_AES_128_GCM_SHA256
  ECDHE curve: X25519
  Signature algorithm: ecdsa_secp256r1_sha256
  Secure renegotiation: no
  Extended master secret: no
  Next protocol negotiated:
  ALPN protocol:
  OCSP staple: no
  SCT list: no
  Early data: yes
  Cert subject: CN = domain.com
  Cert issuer: C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
Error while reading: unknown error type (15)

contents of /tmp/https.txt

Code (Text):

GET / HTTP/1.1
Host: domain.com:443

 

ah yes Nginx master is one that supports early data with upcoming 1.15.3 - got my wires crossed

 

yeah I know.. me = loves mainline

 

AFAIK, patches no longer needed now Nginx 1.15.3 is out for BoringSSL TLS 1.3 Guide for Centmin Mod Nginx users Nginx - Enabling BoringSSL TLS v1.3 with Centmin Mod Nginx HTTP/2 HTTPS Server

 

When I was referring to no longer needed, I meant Nginx 1.15.3 commit for SSL: enabled TLSv1.3 with BoringSSL and SSL: support for TLSv1.3 early data with BoringSSL ensuring Nginx working with BoringSSL and TLS 1.3 as it that it compiled and worked. I didn't check your patches, but I assumed the patches were for BoringSSL compatibility with Nginx 1.15.2 and lower in technically enabling TLS 1.3 itself. Not whether a specific draft or RFC version of TLS 1.3 works with web browsers.

So my assumption was

• Nginx 1.15.2 and below without your BoringSSL patches would not enable any form of TLS 1.3 draft/rfc unless they used your BoringSSL patches
• Nginx 1.15.3 and above without your BoringSSL patches would enable some form of TLS 1.3 whether it's draft/rfc depending on the BoringSSL source code (as you said removal of drafts for final RFC)

Maybe I have my assumption wrong then ?

 

Thanks for the clarification

Here's to web browsers and cloudflare supporting TLS 1.3 RFC final version soon