Beta Branch prep nginx for Cloudflare Post-Quantum KEX support in 130.00beta01

prep nginx for Cloudflare Post-Quantum KEX support in 130.00beta01

- prepare Centmin Mod Nginx to optionally support Cloudflare Post-Quantum key exchange/agreement support allowing Cloudflare to connect to Centmin Mod Nginx origins using Post-Quantum key exchange curve X25519Kyber768Draft00 https://blog.cloudflare.com/post-quantum-to-origins/
- update default nginx.conf's main_json JSON log format to also log ssl_curve, ssl_curves, ssl_session_reused values for visitor requests to be able to confirm if Cloudflare is indeed connecting to Centmin Mod Nginx origin servers via X25519Kyber768Draft00 when Centmin Mod switches from default OpenSSL crypto library to BoringSSL as outlined on documented test Centmin Mod Nginx with Post-Quantum support via BoringSSL

Continue reading...

---

130.00beta01 branch

• Branch: GitHub - centminmod/centminmod at 130.00beta01
• Commit History: Commits · centminmod/centminmod

Support Centmin Mod

If you find Centmin Mod useful, please help support Centmin Mod

 

Centmin Mod LEMP stack which supports various Nginx crypto libraries - BoringSSL, OpenSSL 1.1.1 (default), OpenSSL 3.0/3.1, LibreSSL, QuicTLS OpenSSL 1.1.1/3.0/3.1 and Quiche/BoringSSL for HTTP/3 QUIC.

Example of Centmin Mod Nginx switching from default OpenSSL 1.1.1 to BoringSSL to enable Post-Quantum key exchange support using SSL curve X25519Kyber768Draft00 - preparing for Cloudflare being able to connect to Centmin Mod Nginx origins via more secure Post-Quantum key exchange as outlined at https://blog.cloudflare.com/post-quantum-to-origins/.

1. Switch from default Centmin Mod Nginx built with OpenSSL 1.1.1 crypto library to BoringSSL crypto library by enabling BoringSSL support, by setting in the persistent config file /etc/centminmod/custom_config.inc

Code (Text):

BORINGSSL_SWITCH='y'

2. Run cmupdate and centmin.sh menu option 4 commands to update local Centmin Mod code to latest and then recompile Centmin Mod Nginx with BoringSSL

Code (Text):

cmupdate
centmin

Code (Text):

--------------------------------------------------------
    Centmin Mod Menu 130.00beta01 centminmod.com
--------------------------------------------------------
1).  Centmin Install
2).  Add Nginx vhost domain
3).  NSD setup domain name DNS
4).  Nginx Upgrade / Downgrade
5).  PHP Upgrade / Downgrade
6).  Option Being Revised (TBA)
7).  Option Being Revised (TBA)
8).  Option Being Revised (TBA)
9).  Option Being Revised (TBA)
10). Memcached Server Re-install
11). MariaDB MySQL Upgrade & Management
12). Zend OpCache Install/Re-install
13). Install/Reinstall Redis PHP Extension
14). SELinux disable
15). Install/Reinstall ImagicK PHP Extension
16). Change SSHD Port Number
17). Multi-thread compression: zstd,pigz,pbzip2,lbzip2
18). Suhosin PHP Extension install
19). Install FFMPEG and FFMPEG PHP Extension
20). NSD Install/Re-Install
21). Data Transfer (TBA)
22). Add Wordpress Nginx vhost + Cache Plugin
23). Update Centmin Mod Code Base
24). Exit
--------------------------------------------------------
Enter option [ 1 - 24 ] 4
--------------------------------------------------------

Code (Text):

Nginx Upgrade - Would you like to continue? [y/n] y

Current Nginx Version: 1.24.0 (260923-074355-almalinux9-332935a-br-659b4b3)

Install which version of Nginx? (version i.e. type 1.25.2): 1.25.2

Do you still want to continue? [y/n] y

Centmin Mod Nginx built with optional BoringSSL crypto library. You can ignore warning for nginx: [warn] "ssl_stapling" ignored, not supported as BoringSSL doesn't support OSCP Stapling which isn't a problem if you have Cloudflare in front of Centmin Mod Nginx and only need Cloudflare to talk to Centmin Mod Nginx origin using Post-Quantum key exchange

Check that Nginx version output shows built with OpenSSL 1.1.1 (compatible; BoringSSL) (running with BoringSSL)

Code (Text):

nginx -V
nginx version: nginx/1.25.2 (290923-192121-almalinux9-332935a-br-659b4b3)
built by gcc 12.2.1 20221121 (Red Hat 12.2.1-7) (GCC)
built with OpenSSL 1.1.1 (compatible; BoringSSL) (running with BoringSSL)
TLS SNI support enabled
configure arguments: --with-ld-opt='-Wl,-E -L/usr/local/zlib-cf/lib
-L/opt/boringssl/.openssl/lib -lcrypto -lssl -L/usr/local/nginx-dep/lib -lrt
-ljemalloc -Wl,-z,relro
-Wl,-rpath,/usr/local/zlib-cf/lib:/opt/boringssl/.openssl/lib:/usr/local/nginx-d
ep/lib -flto=8 -fuse-ld=gold' --with-cc-opt='-I/opt/boringssl/.openssl/include
-I/usr/local/zlib-cf/include -I/usr/local/nginx-dep/include -m64 -march=native
-g -O3 -fstack-protector-strong -flto=8 -fuse-ld=gold --param=ssp-buffer-size=4
-Wformat -Werror=format-security -Wno-pointer-sign -Wimplicit-fallthrough=0
-Wno-implicit-function-declaration -Wno-int-conversion -Wno-error=unused-result
-Wno-unused-result -fcode-hoisting -Wno-cast-function-type
-Wno-format-extra-args -Wp,-D_FORTIFY_SOURCE=2'
--sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf
--build=290923-192121-almalinux9-332935a-br-659b4b3 --with-compat
--without-pcre2 --with-http_stub_status_module --with-http_secure_link_module
--with-libatomic --with-http_gzip_static_module
--add-dynamic-module=../ngx_brotli --add-module=../ngx_http_geoip2_module
--with-http_sub_module --with-http_addition_module
--with-http_image_filter_module=dynamic --with-http_geoip_module
--with-stream_geoip_module --with-stream_realip_module
--with-stream_ssl_preread_module --with-threads --with-stream
--with-stream_ssl_module --with-http_realip_module
--add-dynamic-module=../ngx-fancyindex-0.4.2
--add-module=../ngx_cache_purge-2.5.1
--add-dynamic-module=../ngx_devel_kit-0.3.2
--add-dynamic-module=../set-misc-nginx-module-0.33
--add-dynamic-module=../echo-nginx-module-0.63
--add-module=../redis2-nginx-module-0.15
--add-module=../ngx_http_redis-0.4.0-cmm --add-module=../memc-nginx-module-0.19
--add-module=../srcache-nginx-module-0.33
--add-dynamic-module=../headers-more-nginx-module-0.34 --with-pcre-jit
--with-zlib=../zlib-cloudflare-1.3.0 --with-http_ssl_module
--with-http_v2_module

nginx -t
nginx: [warn] "ssl_stapling" ignored, not supported
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

ldd /usr/local/sbin/nginx
       linux-vdso.so.1 (0x00007ffd7494b000)
       libcrypto.so => /opt/boringssl/.openssl/lib/libcrypto.so (0x00007fa90b0ba000)
       libssl.so => /opt/boringssl/.openssl/lib/libssl.so (0x00007fa90b04c000)
       libjemalloc.so.2 => /lib64/libjemalloc.so.2 (0x00007fa90ac00000)
       libcrypt.so.2 => /lib64/libcrypt.so.2 (0x00007fa90b005000)
       libmaxminddb.so.0 => /usr/local/nginx-dep/lib/libmaxminddb.so.0 (0x00007fa90affe000)
       libpcre.so.1 => /usr/local/nginx-dep/lib/libpcre.so.1 (0x00007fa90af85000)
       libGeoIP.so.1 => /lib64/libGeoIP.so.1 (0x00007fa90af46000)
       libatomic_ops.so.1 => /lib64/libatomic_ops.so.1 (0x00007fa90af41000)
       libc.so.6 => /lib64/libc.so.6 (0x00007fa90a800000)
       libstdc++.so.6 => /lib64/libstdc++.so.6 (0x00007fa90a400000)
       libm.so.6 => /lib64/libm.so.6 (0x00007fa90ab25000)
       libgcc_s.so.1 => /lib64/libgcc_s.so.1 (0x00007fa90af24000)
       /lib64/ld-linux-x86-64.so.2 (0x00007fa90b2b4000)

Now that you have Centmin Mod Nginx with BoringSSL, for Post-Quantum key exchange to work you need:

1. Nginx to have ssl_ecdh_curve X25519Kyber768Draft00:X25519; set in only one Nginx HTTPS vhost where listen directive has set default_server. Don't set default_server in other Nginx HTTPS vhosts - once only in one Nginx HTTPS vhost instance's listen directive.

For Nginx 1.25

Code (Text):

  listen 443 ssl default_server;
  http2 on;
  ssl_ecdh_curve X25519Kyber768Draft00:X25519;

For Nginx 1.24

Code (Text):

  listen 443 ssl http2 default_server;
  ssl_ecdh_curve X25519Kyber768Draft00:X25519;

2. The following directives in Nginx HTTPS vhosts

Code (Text):

ssl_prefer_server_ciphers   on;

Centmin Mod already has an include file for/usr/local/nginx/conf/ssl_include.conf which has the following. Make sure TLSv1.3 is set.

Code (Text):

ssl_protocols  TLSv1.2 TLSv1.3;

Ensure you restart Nginx server

Code (Text):

systemctl restart nginx

or via Centmin Mod command shortcut

Code (Text):

ngxrestart

Test using BoringSSL bssl client shows Post-Quantum curve being used ECDHE group: X25519Kyber768Draft00. Change very first line domain= variable to assign your domain name and then run second command

Code (Text):

domain=domain.com
echo | bssl client -server-name $domain -connect $domain:443 -curves X25519:X25519Kyber768Draft00 -debug

example output

Code (Text):

domain=domain.com
echo | bssl client -server-name $domain -connect $domain:443 -curves X25519:X25519Kyber768Draft00 -debug
Connecting to myserverip:443
Handshake started.
Handshake progress: TLS client enter_early_data
Handshake progress: TLS client read_server_hello
Handshake progress: TLS 1.3 client read_hello_retry_request
Handshake progress: TLS 1.3 client read_server_hello
Handshake progress: TLS 1.3 client read_encrypted_extensions
Handshake progress: TLS 1.3 client read_certificate_request
Handshake progress: TLS 1.3 client read_server_certificate
Handshake progress: TLS 1.3 client read_server_certificate_verify
Handshake progress: TLS 1.3 client read_server_finished
Handshake progress: TLS 1.3 client send_end_of_early_data
Handshake progress: TLS 1.3 client send_client_encrypted_extensions
Handshake progress: TLS 1.3 client send_client_certificate
Handshake progress: TLS 1.3 client complete_second_flight
Handshake progress: TLS 1.3 client done
Handshake progress: TLS client finish_client_handshake
Handshake progress: TLS client done
Handshake done.
Connected.
  Version: TLSv1.3
  Resumed session: no
  Cipher: TLS_AES_128_GCM_SHA256
  ECDHE group: X25519Kyber768Draft00
  Signature algorithm: ecdsa_secp256r1_sha256
  Secure renegotiation: yes
  Extended master secret: yes
  Next protocol negotiated:
  ALPN protocol:
  OCSP staple: no
  SCT list: no
  Early data: no
  Encrypted ClientHello: no
  Cert subject: CN = domain.com
  Cert issuer: C = US, O = Let's Encrypt, CN = R3

Seems Cloudflare already has determined my test Centmin Mod Nginx origin with BoringSSL has Post-Quantum key exchange support and is communicating with my origin via X25519Kyber768Draft00

From my Centmin Mod Nginx access logs in JSON format shows ssl_curve for the request from Cloudflare orange cloud enabled site = X25519Kyber768Draft00

Code (Text):

cat access.json | jq -c | tail -1 | jq -r
{
  "msec": "1696111325.536",
  "connection": "1",
  "connection_requests": "1",
  "pid": "1743334",
  "request_id": "e52516e5a82687420646a8b81c0d8e76",
  "request_length": "650",
  "remote_addr": "172.xxx.xxx.xxx",
  "remote_user": "",
  "remote_port": "10544",
  "time_local": "30/Sep/2023:22:02:05 +0000",
  "time_iso8601": "2023-09-30T22:02:05+00:00",
  "request": "GET / HTTP/2.0",
  "request_uri": "/",
  "args": "",
  "status": "304",
  "body_bytes_sent": "0",
  "bytes_sent": "177",
  "http_referer": "",
  "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 OPR/102.0.0.0",
  "http_x_forwarded_for": "2a09:xxx:xxx:xxx:xxx:xxx",
  "http_host": "domain.com",
  "server_name": "domain.com",
  "request_time": "0.000",
  "upstream": "",
  "upstream_connect_time": "",
  "upstream_header_time": "",
  "upstream_response_time": "",
  "upstream_response_length": "",
  "upstream_cache_status": "",
  "ssl_protocol": "TLSv1.3",
  "ssl_session_reused": ".",
  "ssl_cipher": "TLS_AES_128_GCM_SHA256",
  "ssl_curve": "X25519Kyber768Draft00",
  "ssl_curves": "",
  "scheme": "https",
  "request_method": "GET",
  "server_protocol": "HTTP/2.0",
  "pipe": ".",
  "gzip_ratio": "",
  "http_cf_ray": "80efbf881ea0e9bf-BNE",
  "http_cf_worker": "",
  "http_cf_request_id": "",
  "http_cf_railgun": "",
  "http_accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7"
}

Note though BoringSSL does not support dual RSA + ECDSA A SSL certs using DUALCERTS=y setting. So you would only serve one set of SSL certs with it.

 

Yup only using for testing Cloudflare to Centmin Mod Nginx origin support for Post-Quatum key exchange connections. Still a long way to go for production use.

 

FYI, posted a blog post for this if folks just want to test this out at https://blog.centminmod.com/2023/10...68-key-exchange-support-in-centmin-mod-nginx/

 

I get where you're coming from. It's all connected - as I have to focus on technologies that are also beneficial to my paid consulting client work too that pays my bills. And part of that work is consulting on optimizing clients Cloudflare setups for their web sites. Having advanced Cloudflare setup and configuration knowledge for all Cloudflare products and services is part of my paid work

Also this was tested on EL8/EL9 oses so it's still testing for future compatibility of Nginx BoringSSL routines and fixed bugs revealed in Nginx routine And is now part of automated Nginx + BoringSSL routine tests I have setup to make future testing easier for EL8+ and beyond. I have almost all Centmin Mod routines setup for automated testing soon. This will help future testing and development. Again as I said, it's all connected

Example of the automated testing for EL8/EL9 - one test run can test AlmaLinux vs RockyLinux vs Oracle Linux all at same time. This automated testing has helped me catch bugs and improve routines in EL8/EL9

 

That's what the currently private 130.00beta01 EL8+ compatible installer is for. That EL8+ installer code isn't going to change much whether it's in private beta or eventual public beta right now. In either case of private or public EL8+ beta, if bugs arise they will have the same fixes.

If you are concerned with the quality of the private 130.00beta01 EL8+ beta, then it makes more sense to do more in-depth testing for your specific usage cases now during the private beta and report any bugs, than waiting on the public EL8+ beta announcement as you'd have less Centmin Mod users competing for my time/responses during the private beta testing

 

Public EL8 beta is coming soon. It's always been planned for

 

perfect example of this is @MaximilianKohler recent post for his specific usage and PostgreSQL requirements https://community.centminmod.com/th...w-vhost-in-addition-to-a-forum-xenforo.24123/ is essentially a bug report and reminder for me as I forgot to add PostgreSQL routines for EL8 and EL9 compatibility. So now have added them https://community.centminmod.com/th...16-add-el8-el9-support-in-130-00beta01.24124/ and also added automated tests for PostgreSQL routines for EL8 and EL9 With automated testing now in place, PostgreSQL routines will never be left out of EL8/EL9 and future testing