Hacker News Reader

Comment by slivanes | Hacker News Reader

Right now, nginx 1.13.x requires compiling against OpenSSL 1.1.1 or newer to get TLSv1.3 supported in browsers.

You need to compile the "draft-18" branch of OpenSSL as current browsers are on draft-18 (master is on draft-19).

that's the biggest weakness of nginx.... the whole compile stuff in a right way to get things/features really running there. And don't tell me it's easy to recompile nginx... you have to know a lot of nginx and switches to get the compiler setup well done.

Then don't write a compile-recipe from scratch, but take e.g. your distro's packaging script & just add the switch you need. This is easy and relatively fool-proof.

Apache is also a giant pain in the ass to get http2 support, you have to basically chuck out the distro packages and do everything from scratch (including OpenSSL) unless you're on a bleeding edge distro.

Not to mention that http2 is buggy in 2.4.25 (fixes in 2.4.26 will be out in May). And yes, without a bleeding edge distro good luck.

Building apache from source is not only very straightforward but a great way to maximimize httpd performance (all modules static, only include the modules you need). OpenSSL on the other hand, that's distro specific, and definitely more involved.

at least RHEL/CentOS 7.4 will move to OpenSSL 1.0.2 for APLN and HTTP/2 support :)

or just script it to do all the leg work which is what I do with my LEMP installer for TLS v1.3 support and optional nginx compile against LibreSSL or OpenSSL or later BoringSSL https://community.centminmod.com/posts/48818/

  git clone https://github.com/openssl/openssl.git -b tls1.3-draft-18 openssl-1.1.1-tls1.3-draft-18

Is this like, the fine print?

Reply on news.ycombinator.com