ECH Without Padding Is a Lookup Table
by Danila Vershinin, September 10, 2026
ECH hides the SNI, yet every vhost we measured, 8 of 8 in the lab and 5 of 5 in production, was identifiable from server handshake record sizes alone. Here is the measured leak, and the one-directive NGINX module that closes it.
Read More...NGINX TLS Vulnerability Fixes: BREACH, SWEET32, ROBOT
by Danila Vershinin, September 6, 2026
One directive, ssl_protocols TLSv1.3;, eliminates ROBOT, SWEET32 and Lucky13 outright. BREACH survives in HTTP compression and needs a scoped gzip off. Every fix runtime-tested, plus the post-quantum step beyond.
Read More...OpenSSL 4.0 for NGINX: Why We Ship 3.5 LTS Instead
by Danila Vershinin, August 30, 2026
OpenSSL 4.0 for NGINX drops out of support in May 2027. OpenSSL 3.5 LTS runs to April 2030 and already does post-quantum key exchange. Here is the arithmetic behind our choice, and the one 4.0 feature worth having.
Read More...Post-Quantum NGINX: OpenSSL 3.5 on Debian and Ubuntu
by Danila Vershinin, August 29, 2026
Every Debian and Ubuntu suite we publish now links our ABI-isolated OpenSSL 3.5 LTS build, so post-quantum key exchange, Encrypted Client Hello and TLS certificate compression arrive on DEB too. Ubuntu 20.04’s NGINX no longer links end-of-life OpenSSL 1.1.1.
Read More...NGINX Certificate Compression: RFC 8879 for Every Browser
by Danila Vershinin,
NGINX certificate compression (RFC 8879) shrinks the TLS handshake by around 20% on every fresh connection, and it takes one directive. The catch is packaging: your distribution’s NGINX is too old to have the directive, and its OpenSSL was built without the brotli algorithm that Chrome is the only browser to ask for. Measured, and with the one directive that stops NGINX from starting.
Read More...NGINX Post-Quantum TLS: X25519MLKEM768 with OpenSSL 3.5
by Danila Vershinin,
Our RPM and DEB builds now link OpenSSL 3.5, so hybrid post-quantum key exchange with X25519MLKEM768 works out of the box on every platform we package for — from RHEL 8 to Ubuntu 20.04. Here is how to verify it, and the one common hardening directive that silently turns it off.
Read More...Encrypted Client Hello in NGINX: Now Shipping in Our RPMs and DEBs
by Danila Vershinin, August 25, 2026
Server-side ECH (RFC 9849) is live in our stock NGINX, NGINX-MOD and EDGE packages, on RPM and DEB alike, built on OpenSSL 3.5 LTS with the DEfO backport. Here is what it hides, what it does not, and how to run it with automatic key rotation.
Read More...NGINX ACME Module: Let’s Encrypt SSL Without Certbot
by Danila Vershinin, June 29, 2026
Issue and auto-renew Let’s Encrypt certificates directly inside NGINX with the nginx-module-acme module. No certbot, no cron jobs, no downtime, no Python.
Read More...NGINX Dynamic TLS Records: An Honest Benchmark in 2026
by Danila Vershinin, April 29, 2026
We rebuilt nginx-mod with Cloudflare’s 2015 dynamic TLS records patch and benchmarked it in a controlled rig with random interleave, CPU pinning, and 200 cold connections per condition. The “50% p95 TTFB win” we expected collapsed under noise control. Here are the honest numbers and what to do instead.
Read More...aws-lc NGINX in 2026: Why we still ship quictls
by Danila Vershinin, April 26, 2026
Why GetPageSpeed packages aws-lc on EL but still links nginx-mod against quictls in 2026: the honest current state of TLS for NGINX HTTP/3.
Read More...Recommended Web Hosting
