]> git.feebdaed.xyz Git - 0xmirror/nginx.git/commit
SSL: support for compressed server certificates with BoringSSL.
authorSergey Kandaurov <pluknet@nginx.com>
Tue, 15 Jul 2025 18:22:53 +0000 (22:22 +0400)
committerpluknet <s.kandaurov@f5.com>
Wed, 8 Oct 2025 15:56:41 +0000 (19:56 +0400)
commit78d1ab5a2c00839a36ff6bac661d9785fce3c1a4
tree4ac4bd5b44b6d092cd32e32e0b824323235b31a7
parent25b03d650087b4d653f99a7ce65582ab565c5a44
SSL: support for compressed server certificates with BoringSSL.

BoringSSL/AWS-LC provide two callbacks for each compression algorithm,
which may be used to compress and decompress certificates in runtime.
This change implements compression support with zlib, as enabled with
the ssl_certificate_compression directive.  Compressed certificates
are stored in certificate exdata and reused in subsequent connections.

Notably, AWS-LC saves an X509 pointer in SSL connection, which allows
to use it from SSL_get_certificate() for caching purpose.  In contrast,
BoringSSL reconstructs X509 on-the-fly, though given that it doesn't
support multiple certificates, always replacing previously configured
certificates, we use the last configured one from ssl->certs, instead.
src/event/ngx_event_openssl.c
src/event/ngx_event_openssl.h