ECH Without Padding Is a Lookup Table
ECH hides the SNI, yet every vhost we measured, 8 of 8 in the lab and 5 of 5 in production, was identifiable from…
Infrastructure, understood.
Practical guides to performance, security and life beyond end of support.
NGINX Directive Execution Order: The 11 Request Phases
How NGINX directive execution order really works: the 11 request phases, why return beats deny, why a server rewrite changes your location, and where…
NGINX proxy_pass: URI Rewriting, Variables, and DNS Gotchas
The exact proxy_pass URI rewriting rules, variable resolution gotchas, and three verified ways to fix NGINX's frozen-DNS problem, including the upstream-jdomain module.
NGINX TLS Vulnerability Fixes: BREACH, SWEET32, ROBOT
One directive, ssl_protocols TLSv1.3;, eliminates ROBOT, SWEET32 and Lucky13 outright. BREACH survives in HTTP compression and needs a scoped gzip off. Every fix runtime-tested,…
NGINX RADIUS Authentication: No More htpasswd Files
Stock NGINX cannot talk to RADIUS. The nginx-module-auth-radius package adds RFC 2865 authentication with multi-server failover, verified end to end against FreeRADIUS, including the…
zstd-nginx-module: Maintained, Tested and Packaged
The canonical Zstandard module for NGINX has had no release since 2023. We continue it: the streaming bugs that truncated large responses are fixed…
OpenSSL 4.0 for NGINX: Why We Ship 3.5 LTS Instead
OpenSSL 4.0 for NGINX drops out of support in May 2027. OpenSSL 3.5 LTS runs to April 2030 and already does post-quantum key exchange.…
Post-Quantum NGINX: OpenSSL 3.5 on Debian and Ubuntu
Every Debian and Ubuntu suite we publish now links our ABI-isolated OpenSSL 3.5 LTS build, so post-quantum key exchange, Encrypted Client Hello and TLS…
NGINX Certificate Compression: RFC 8879 for Every Browser
NGINX certificate compression (RFC 8879) shrinks the TLS handshake by around 20% on every fresh connection, and it takes one directive. The catch is…
NGINX Post-Quantum TLS: X25519MLKEM768 with OpenSSL 3.5
Our RPM and DEB builds now link OpenSSL 3.5, so hybrid post-quantum key exchange with X25519MLKEM768 works out of the box on every platform…