https://hg.nginx.org/nginx/ en-us nginx Changelog nginx Changelog [default] SSL: support for compressed server certificates with BoringSSL. https://hg.nginx.org/nginx/rev/c3be84605871 https://hg.nginx.org/nginx/rev/c3be84605871 changeset c3be84605871 branch default bookmark tag tip user Sergey Kandaurov <pluknet@nginx.com> description SSL: support for compressed server certificates with BoringSSL.

BoringSSL/AWS-LC provide two callbacks for each compression algorithm,
which may be used to compress and decompress certificates in runtime.
This change implements compression support with zlib, as enabled with
the ssl_certificate_compression directive. Compressed certificates
are stored in certificate exdata and reused in subsequent connections.

Notably, AWS-LC saves an X509 pointer in SSL connection, which allows
to use it from SSL_get_certificate() for caching purpose. In contrast,
BoringSSL reconstructs X509 on-the-fly, though given that it doesn't
support multiple certificates, always replacing previously configured
certificates, we use the last configured one from ssl->certs, instead. files src/event/ngx_event_openssl.c
src/event/ngx_event_openssl.h
]]> Sergey Kandaurov <pluknet@nginx.com> Tue, 15 Jul 2025 22:22:53 +0400 SSL: disabled using certificate compression with OCSP stapling. https://hg.nginx.org/nginx/rev/0844ed63b6bd https://hg.nginx.org/nginx/rev/0844ed63b6bd changeset 0844ed63b6bd branch bookmark tag user Sergey Kandaurov <pluknet@nginx.com> description SSL: disabled using certificate compression with OCSP stapling.

OCSP response in TLSv1.3 is sent in the Certificate message. This
is incompatible with pre-compression of the configured certificates. files src/http/modules/ngx_http_ssl_module.c
src/stream/ngx_stream_ssl_module.c
]]> Sergey Kandaurov <pluknet@nginx.com> Thu, 02 Oct 2025 15:22:24 +0400 Updated OpenSSL and PCRE used for win32 builds. https://hg.nginx.org/nginx/rev/46b715093fe3 https://hg.nginx.org/nginx/rev/46b715093fe3 changeset 46b715093fe3 branch bookmark tag user Sergey Kandaurov <pluknet@nginx.com> description Updated OpenSSL and PCRE used for win32 builds. files misc/GNUmakefile
]]> Sergey Kandaurov <pluknet@nginx.com> Tue, 07 Oct 2025 22:21:37 +0400 Version bump. https://hg.nginx.org/nginx/rev/279676b97237 https://hg.nginx.org/nginx/rev/279676b97237 changeset 279676b97237 branch bookmark tag user Sergey Kandaurov <pluknet@nginx.com> description Version bump. files src/core/nginx.h
]]> Sergey Kandaurov <pluknet@nginx.com> Tue, 07 Oct 2025 22:19:01 +0400 nginx-1.29.2-RELEASE https://hg.nginx.org/nginx/rev/d2a04c09eb4d https://hg.nginx.org/nginx/rev/d2a04c09eb4d changeset d2a04c09eb4d branch bookmark tag user Sergey Kandaurov <pluknet@nginx.com> description nginx-1.29.2-RELEASE files docs/xml/nginx/changes.xml
]]> Sergey Kandaurov <pluknet@nginx.com> Tue, 07 Oct 2025 16:46:15 +0400 Fixed a typo. https://hg.nginx.org/nginx/rev/0d188d92c12d https://hg.nginx.org/nginx/rev/0d188d92c12d changeset 0d188d92c12d branch bookmark tag user Sergey Kandaurov <pluknet@nginx.com> description Fixed a typo. files docs/xml/nginx/changes.xml
]]> Sergey Kandaurov <pluknet@nginx.com> Tue, 07 Oct 2025 17:05:09 +0400 SSL: fixed "key values mismatch" with object cache inheritance. https://hg.nginx.org/nginx/rev/c97c240aabbe https://hg.nginx.org/nginx/rev/c97c240aabbe changeset c97c240aabbe branch bookmark tag user Sergey Kandaurov <pluknet@nginx.com> description SSL: fixed "key values mismatch" with object cache inheritance.

In rare cases, it was possible to get into this error state on reload
with improperly updated file timestamps for certificate and key pairs.

The fix is to retry on X509_R_KEY_VALUES_MISMATCH, similar to 5d5d9adcc.
Additionally, loading SSL certificate is updated to avoid certificates
discarded on retry to appear in ssl->certs and in extra chain. files src/event/ngx_event_openssl.c
src/event/ngx_event_openssl_cache.c
]]> Sergey Kandaurov <pluknet@nginx.com> Thu, 29 May 2025 17:49:48 +0400 Added F5 CLA workflow. https://hg.nginx.org/nginx/rev/fd6242dfb464 https://hg.nginx.org/nginx/rev/fd6242dfb464 changeset fd6242dfb464 branch bookmark tag user Maryna-f5 <84339011+Maryna-f5@users.noreply.github.com> description Added F5 CLA workflow. files .github/workflows/f5_cla.yml
]]> Maryna-f5 <84339011+Maryna-f5@users.noreply.github.com> Thu, 25 Sep 2025 12:51:40 -0700 Mail: xtext encoding (RFC 3461) in XCLIENT LOGIN. https://hg.nginx.org/nginx/rev/0954f084ffc0 https://hg.nginx.org/nginx/rev/0954f084ffc0 changeset 0954f084ffc0 branch bookmark tag user Sergey Kandaurov <pluknet@nginx.com> description Mail: xtext encoding (RFC 3461) in XCLIENT LOGIN.

The XCLIENT command uses xtext encoding for attribute values,
as specified in https://www.postfix.org/XCLIENT_README.html.

Reported by Igor Morgenstern of Aisle Research. files src/core/ngx_string.c
src/core/ngx_string.h
src/mail/ngx_mail_proxy_module.c
]]> Sergey Kandaurov <pluknet@nginx.com> Thu, 11 Sep 2025 18:23:10 +0400 Upstream: overflow detection in Cache-Control delta-seconds. https://hg.nginx.org/nginx/rev/4f55535cf345 https://hg.nginx.org/nginx/rev/4f55535cf345 changeset 4f55535cf345 branch bookmark tag user Sergey Kandaurov <pluknet@nginx.com> description Upstream: overflow detection in Cache-Control delta-seconds.

Overflowing calculations are now aligned to the greatest positive integer
as specified in RFC 9111, Section 1.2.2. files src/http/ngx_http_upstream.c
]]> Sergey Kandaurov <pluknet@nginx.com> Wed, 10 Sep 2025 18:39:52 +0400