HN Explorer

40 comments

[ 3.3 ms ] story [ 84.6 ms ] thread
aorth
Oh. So that's what they meant by "variables support" in the ssl directives. I didn't realize the significance of that change when I read the changelog earlier today.
zorpner
Bear in mind: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_c...

    Note that using variables implies that a certificate will be loaded for each SSL handshake, and this may have a negative impact on performance.
Still a great feature. About to significantly simplify a few complex deployments I'm running.
chupasaurus
Mostly likely the certificates will stay in filesystem's cache because of the number of reads, and memcpy of some pages isn't a huge deal unless you're having 100K+ active and short-lived sessions per nginx instance.
ptman
Parsing is probably slower than memcpy
chupasaurus
Fair enough, but the server parses only the private key which is already well structured in any encoding. I haven't checked myself, but I believe correctness checks are ran on the reloading of a configuration.
uasm
That's a strange disclaimer. There should've been a cache there.
zaarn
You have a cache, if you SIGHUP the nginx process it'll reload the config and certificates on disk. With a simple script it is possible to SIGHUP when the certificate file is changed on disk.
scurvy
Does nginx still halt the master process when you have more than 70k cert/key pairs and send it a hup?
regecks
Strange and potentially busted, if that interpretation is correct.

What if your ACME client is updating the certificate and private key when an nginx connection comes in?

You can't atomically update both files, right? So nginx will potentially see a mismatched key and certificate?

:\

I hope it's guarded by SIGHUP, like sibling comment suggests.

emersion
ACME clients should write the private key and certificate to a temporary file, then move it to the final destination so that the change is atomic.
spatz
That would work for one file but there's no way to atomically rename two.
regecks
I suppose you could do it if you placed them in a directory, and renamed that. But I don't think that's what Certbot does, I think it works by changing file symlinks individually.
tinus_hn
The actual problem is the other way around: you can’t open two files atomically.
rubatuga
You should only need to update the certificate not the private key
scurvy
There's a format that stores key and cert in the same file. Name escapes me now and I'm not sure if nginx supports it.

Edit: it does. Just use that instead of messing with separate files

nightfly
The change to /each/ file is atomic, but both updates /together/ aren't atomic.
weinzierl
Put them in a diectory and move the directory?
kilburn
This won't work AFAIK.

open takes a file path and gives you back a fd that doesn't know anything about fs paths (it tracks the underlying inode).

Thus, nginx may open(key) before the directory is renamed, and open(cert) afterwards. The first fd is now pointing to the old key, while the second fd points to the new cert.

nightfly
The actual problem is you can't atomically replace a directory with another one. You have to do tricks where you have a symlink to the real directory and atomically replace the symlink with a new symlink to the new directory.

Another comment pointed out though that most of the time you only need to update the cert, and not the key. So it's mostly a moot issue..

daenney
You don't need to atomically replace 2 files. Renewing the certificate does not entail changing the private key, so unless you toss away the private key yourself you won't get a mismatched key and certificate situation.

It only needs to update the certificate, a single operation, which can be done atomically. Certificates are also renewed ahead of time so a previous connection still having the old cert is not an issue.

scurvy
Is it still best practice to create a new key on cert renewal? It was just a few years ago.
regecks
FWIW, Certbot does, by default, replace the private key on renewal.
subway
Nifty. I've been using ssl_certificate_by_lua_block from the openresty nginx lua module to accomplish this.
clon
I cannot find any any information on how this data is sanitized.

   /safe/path/$hostname.key
   $hostname = ../../etc/some/secret
   /safe/path/../../etc/some/secret.key
[dead] magicnmonkey
Who needs Russian spyware engine X when we now have American Build High Performance Caddy where you can actually get prosecuted if you try to spy on your users without declaring it upfront!

We shouldn't use why software coming out of Russia

gregoriol
Why are they still supporting Windows Vista?!
chemodax
Most likely because of Windows Server 2008: they are almost the same.
tinus_hn
If there is a feature ‘for Windows Vista or newer’ that implies they support even older versions.
pas
Probably that's the version that introduced the poll API. They developed it on Win10, then noticed oh it should work on Vista. Tested it [maybe] and put it in the changelog. (And probably they have nginxplus customers that need Vista support?)