yum upgrades for production use, this is the repository for you.
Active subscription is required.
Technical Briefing: Post-Quantum NGINX with OpenSSL 3.5 on Debian and Ubuntu
Problem Statement
NGINX packages on Debian and Ubuntu previously linked against each distribution’s system OpenSSL. On Ubuntu 20.04 (focal), that meant OpenSSL 1.1.1, which reached upstream end-of-life on 11 September 2023. This also constrained which TLS features were available depending on the suite, and left DEB and RPM builds as separate stacks.
Implementation
NGINX packages on Debian and Ubuntu now link against an ABI-isolated OpenSSL 3.5 LTS build (openssl35) rather than the distribution’s system OpenSSL. A plain apt-get install nginx or apt-get upgrade brings this across; no configuration changes are required. As of late August 2026, focal packages no longer link OpenSSL 1.1.1, and the DEB and RPM builds are now a single stack.
Features this enables
X25519MLKEM768— post-quantum key exchange, on by default, negotiated by current Chrome and Firefox without configuration. One common hardening directive silently disables it; the post-quantum TLS guide covers verification and that caveat.ssl_ech_fileplus a newnginx-echpackage for Encrypted Client Hello (ECH) key rotation.
Every listed suite is published for both amd64 and arm64.
Debian 13 (Trixie) special case
Trixie’s system OpenSSL is already 3.5, but it ships NGINX 1.26.3, which predates ssl_certificate_compression and has no ECH support. Both the TLS library and NGINX must be new enough, and only one source provides both.
Module compatibility
Every nginx-module-* package in the DEB repository is pinned to the NGINX ABI via the virtual nginx-r1.30.4 provided by the NGINX package, not to the TLS library. Swapping OpenSSL underneath does not invalidate that, so installed modules keep loading, and anything needing a newer NGINX arrives in the same apt-get upgrade.
Verification
To verify the actual linked library (not the CLI tool, which may differ):
nginx -V 2>&1 | grep "built with"
It should report:
built with OpenSSL 3.5.8+gps 25 Aug 2026
Verified in clean containers on Ubuntu 20.04 amd64 and Debian 13 arm64. If it still names the distribution’s OpenSSL, you are on a pre-switch package and apt-get upgrade is the entire migration.
The library lives in its own directory with its own SONAMEs, so it cannot disturb anything else:
ldd /usr/sbin/nginx | grep ssl
libssl.so.35.3 => /usr/lib/x86_64-linux-gnu/openssl35/libssl.so.35.3
The system OpenSSL is untouched.
Upgrade-Day Caveat
NGINX loads its TLS library when the master process starts, so a reload re-reads configuration but keeps the old library mapped. The packages handle the graceful binary handover when NGINX itself is upgraded; this only matters when upgrading openssl35-libs alone. In that case, run systemctl restart nginx rather than a reload.
Rationale: Why 3.5 Rather Than 4.0
3.5 is the LTS release, supported to April 2030, while 4.0 is not an LTS and drops out in May 2027. ECH was backported onto 3.5 rather than moving the fleet to 4.0, which would have bought a shorter support window and removed hardware key support.
External Verification
The SSL test reports post-quantum key exchange, ECH, and certificate compression as first-class results.
Setup
New installations:
sudo apt-get update
sudo apt-get install nginx
Existing installations:
sudo apt-get upgrade
Coming from a third-party PPA, a migration guide covers the pinning needed to make the switch stick.
Availability
Repository metadata is public; downloading packages requires an active subscription.
Read the full article: Post-Quantum NGINX: OpenSSL 3.5 on Debian and Ubuntu
