OpenSSL 4.0 for NGINX: Why We Ship 3.5 LTS Instead
OpenSSL 4.0 for NGINX drops out of support in May 2027. OpenSSL 3.5 LTS runs to April 2030 and already does post-quantum key exchange. Here is the arithmetic behind our choice, and the one 4.0 feature worth having.
#Ech, #Lts, #Nginx, #Openssl, #Packaging, #PostQuantum, #Security, #Tls
OpenSSL 4.0 for NGINX drops out of support in May 2027. OpenSSL 3.5 LTS runs to April 2030 and already does post-quantum key exchange. Here is the arithmetic behind our choice, and the one 4.0 feature worth having.
#Ech, #Lts, #Nginx, #Openssl, #Packaging, #PostQuantum, #Security, #Tls
🚀 Fresh updates from GetPageSpeed
- gixy
A static security analyzer for NGINX configurations that helps prevent common misconfigurations and vulnerabilities.
Did you know? Gixy can detect issues like SSRF, host header injection, and CRLF injection before they ever reach production.
- gixy-deep
Installs Gixy together with ReDoctor, enabling optional deep analysis of regular expressions in your NGINX configs.
Did you know? ReDoctor can uncover catastrophic backtracking in regex patterns — a common cause of ReDoS attacks and CPU spikes.
- python3-gixy
Python 3 bindings for the Gixy NGINX security analyzer.
Did you know? Gixy is written in Python and can be easily extended with custom security checks via plugins.
- python36-gixy
Python 3.6 build of Gixy for legacy Enterprise Linux 7 systems.
Did you know? EL7 remains widely used in production, and this build ensures older systems stay protected with the latest NGINX security checks.
- fail2ban-trusted-lists-helper
Exempts any IP found in
Did you know? This helper lets you maintain a single trusted-IP directory — perfect for keeping your monitoring or VPN IPs permanently whitelisted.
- gixy
0.2.52 released to Amazon Linux 2/2023, Enterprise Linux 7–10, Fedora 43/44, and SUSE Linux Enterprise 16.A static security analyzer for NGINX configurations that helps prevent common misconfigurations and vulnerabilities.
Did you know? Gixy can detect issues like SSRF, host header injection, and CRLF injection before they ever reach production.
- gixy-deep
0.2.52 released to Amazon Linux 2/2023, Enterprise Linux 7–10, Fedora 43/44, and SUSE Linux Enterprise 16.Installs Gixy together with ReDoctor, enabling optional deep analysis of regular expressions in your NGINX configs.
Did you know? ReDoctor can uncover catastrophic backtracking in regex patterns — a common cause of ReDoS attacks and CPU spikes.
- python3-gixy
0.2.52 released to Amazon Linux 2/2023, Enterprise Linux 8–10, Fedora 43/44, and SUSE Linux Enterprise 16.Python 3 bindings for the Gixy NGINX security analyzer.
Did you know? Gixy is written in Python and can be easily extended with custom security checks via plugins.
- python36-gixy
0.2.52 released to Enterprise Linux 7.Python 3.6 build of Gixy for legacy Enterprise Linux 7 systems.
Did you know? EL7 remains widely used in production, and this build ensures older systems stay protected with the latest NGINX security checks.
- fail2ban-trusted-lists-helper
20260602 released to Amazon Linux 2/2023, Enterprise Linux 7–10, Fedora 43/44, and SUSE Linux Enterprise 16.Exempts any IP found in
/usr/share/trusted-lists/plain/*.txt from every fail2ban jail.Did you know? This helper lets you maintain a single trusted-IP directory — perfect for keeping your monitoring or VPN IPs permanently whitelisted.
🚀 **Fresh updates from GetPageSpeed**
- **firewalld-ipset-aws-v4**
Amazon Web Services IPv4 ranges for firewalld ipset.
Did you know? Firewalld uses ipsets to efficiently manage thousands of IP addresses without cluttering the main ruleset.
- **firewalld-ipset-aws-v6**
Amazon Web Services IPv6 ranges for firewalld ipset.
Did you know? IPv6 ranges are increasingly critical as AWS expands its dual-stack support across services.
- **nginx-iplist-aws-v4**
NGINX IP list configuration for AWS IPv4 ranges.
Did you know? NGINX can use geo/allow lists to restrict access by cloud provider IP ranges, a common trick for API security.
- **nginx-iplist-aws-v6**
NGINX IP list configuration for AWS IPv6 ranges.
Did you know? Combining v4 and v6 lists ensures full coverage as more clients adopt IPv6.
- **aws-lc**
AWS-LC is a general-purpose cryptographic library maintained by the AWS Cryptography team.
Did you know? AWS-LC is a fork of BoringSSL, optimized for AWS workloads and used in services like S3 and CloudFront.
- **aws-lc-devel**
Headers and pkg-config files for building software against AWS-LC.
Did you know? The devel package is essential for compiling applications that link against AWS-LC, ensuring ABI compatibility.
- **aws-lc-libs**
- **firewalld-ipset-aws-v4**
20260901 released to Amazon Linux 2 & 2023, Enterprise Linux 7–10, Fedora 43 & 44, and SUSE Linux Enterprise 16.Amazon Web Services IPv4 ranges for firewalld ipset.
Did you know? Firewalld uses ipsets to efficiently manage thousands of IP addresses without cluttering the main ruleset.
- **firewalld-ipset-aws-v6**
20260901 released to Amazon Linux 2 & 2023, Enterprise Linux 7–10, Fedora 43 & 44, and SUSE Linux Enterprise 16.Amazon Web Services IPv6 ranges for firewalld ipset.
Did you know? IPv6 ranges are increasingly critical as AWS expands its dual-stack support across services.
- **nginx-iplist-aws-v4**
20260901 released to Amazon Linux 2 & 2023, Enterprise Linux 7–10, Fedora 43 & 44, and SUSE Linux Enterprise 16.NGINX IP list configuration for AWS IPv4 ranges.
Did you know? NGINX can use geo/allow lists to restrict access by cloud provider IP ranges, a common trick for API security.
- **nginx-iplist-aws-v6**
20260901 released to Amazon Linux 2 & 2023, Enterprise Linux 7–10, Fedora 43 & 44, and SUSE Linux Enterprise 16.NGINX IP list configuration for AWS IPv6 ranges.
Did you know? Combining v4 and v6 lists ensures full coverage as more clients adopt IPv6.
- **aws-lc**
5.7.0 released to Amazon Linux 2 & 2023, Enterprise Linux 7–10, Fedora 43 & 44, and SUSE Linux Enterprise 16.AWS-LC is a general-purpose cryptographic library maintained by the AWS Cryptography team.
Did you know? AWS-LC is a fork of BoringSSL, optimized for AWS workloads and used in services like S3 and CloudFront.
- **aws-lc-devel**
5.7.0 released to Amazon Linux 2 & 2023, Enterprise Linux 7–10, Fedora 43 & 44, and SUSE Linux Enterprise 16.Headers and pkg-config files for building software against AWS-LC.
Did you know? The devel package is essential for compiling applications that link against AWS-LC, ensuring ABI compatibility.
- **aws-lc-libs**
5.7.0 released tozstd-nginx-module: Maintained, Tested and Packaged
The canonical Zstandard module for NGINX has had no release since 2023. We continue it: the streaming bugs that truncated large responses are fixed and regression-tested, and it ships as nginx-module-zstd on every distribution we build for.
#Compression, #Http, #Nginx, #Packaging, #Testing, #Zstd
The canonical Zstandard module for NGINX has had no release since 2023. We continue it: the streaming bugs that truncated large responses are fixed and regression-tested, and it ships as nginx-module-zstd on every distribution we build for.
#Compression, #Http, #Nginx, #Packaging, #Testing, #Zstd
👍1
🚀 **Fresh updates from GetPageSpeed**
- freenginx
Freenginx is an HTTP and reverse proxy server, as well as a mail proxy server.
Did you know? Freenginx is a community-driven fork of nginx created by its original author, Igor Sysoev.
- freenginx-ech
Provides key generation and rotation for Encrypted Client Hello (ECH, RFC 9849).
Did you know? ECH encrypts the full TLS handshake, hiding the requested hostname from network observers.
- firewalld-ipset-aws-v6
Provides Amazon Web Services IPv6 ranges for firewalld ipset use.
Did you know? AWS publishes its IP ranges in JSON format, updated daily.
- firewalld-ipset-googlebot-v4/v6
Provides Google Search crawler (Googlebot) IP ranges for firewalld.
Did you know? Googlebot respects robots.txt, but verifying its IP addresses helps prevent fake crawler traffic.
- firewalld-ipset-google-special-crawlers-v4/v6
Provides Google special-case crawlers (AdsBot, etc.) IP ranges for firewalld.
Did you know? AdsBot checks ad landing page quality, separate from regular search indexing.
- firewalld-ipset-google-user-fetchers-v4/v6
Provides Google user-triggered fetchers IP ranges for firewalld.
Did you know? Google user-triggered fetchers include requests from Google's cache refresh and URL inspection tools.
- firewalld-ipset-google-v4/v6
Combined Google crawler IP ranges (Googlebot, special-crawlers, user-fetchers) for firewalld.
Did you know? Google's crawler IP space is shared with other Google services, so always verify with reverse
- freenginx
1.31.4 released to Amazon Linux, Enterprise Linux, Fedora, and SUSE.Freenginx is an HTTP and reverse proxy server, as well as a mail proxy server.
Did you know? Freenginx is a community-driven fork of nginx created by its original author, Igor Sysoev.
- freenginx-ech
1.31.4 released to Amazon Linux, Enterprise Linux, Fedora, and SUSE.Provides key generation and rotation for Encrypted Client Hello (ECH, RFC 9849).
Did you know? ECH encrypts the full TLS handshake, hiding the requested hostname from network observers.
- firewalld-ipset-aws-v6
20260902 released to Amazon Linux, Enterprise Linux, Fedora, and SUSE.Provides Amazon Web Services IPv6 ranges for firewalld ipset use.
Did you know? AWS publishes its IP ranges in JSON format, updated daily.
- firewalld-ipset-googlebot-v4/v6
20260902 released to Amazon Linux, Enterprise Linux, Fedora, and SUSE.Provides Google Search crawler (Googlebot) IP ranges for firewalld.
Did you know? Googlebot respects robots.txt, but verifying its IP addresses helps prevent fake crawler traffic.
- firewalld-ipset-google-special-crawlers-v4/v6
20260902 released to Amazon Linux, Enterprise Linux, Fedora, and SUSE.Provides Google special-case crawlers (AdsBot, etc.) IP ranges for firewalld.
Did you know? AdsBot checks ad landing page quality, separate from regular search indexing.
- firewalld-ipset-google-user-fetchers-v4/v6
20260902 released to Amazon Linux, Enterprise Linux, Fedora, and SUSE.Provides Google user-triggered fetchers IP ranges for firewalld.
Did you know? Google user-triggered fetchers include requests from Google's cache refresh and URL inspection tools.
- firewalld-ipset-google-v4/v6
20260902 released to Amazon Linux, Enterprise Linux, Fedora, and SUSE.Combined Google crawler IP ranges (Googlebot, special-crawlers, user-fetchers) for firewalld.
Did you know? Google's crawler IP space is shared with other Google services, so always verify with reverse
🚀 **Fresh updates from GetPageSpeed**
- **nginx**
High-performance HTTP and reverse proxy server.
Did you know? NGINX was created by Igor Sysoev and first released in 2004 to solve the C10K problem.
- **nginx-ech**
Key generation and rotation for Encrypted Client Hello (ECH, RFC 9849).
Did you know? ECH encrypts the entire TLS handshake, hiding the Server Name Indication (SNI) from network observers.
- **telegram-desktop**
Official Telegram messaging app for Linux desktop.
Did you know? Telegram's MTProto protocol was designed by Nikolai Durov, brother of founder Pavel Durov.
- **nginx-module-media-framework**
Distributed framework for live video streaming.
Did you know? This module supports adaptive bitrate streaming, letting viewers automatically get the best quality for their connection.
- **nginx-module-brotli**
Brotli compression dynamic modules for NGINX.
Did you know? Brotli was developed by Google and can compress text up to 20% better than gzip.
- **nginx-module-waf**
Web application firewall module for NGINX.
Did you know? A WAF can block SQL injection, XSS, and other OWASP Top 10 attacks before they reach your application.
- **nginx-module-security**
- **nginx**
1.31.5 released to Amazon Linux 2/2023, Enterprise Linux 7–10, Fedora 43/44, and SLES 16.High-performance HTTP and reverse proxy server.
Did you know? NGINX was created by Igor Sysoev and first released in 2004 to solve the C10K problem.
- **nginx-ech**
1.31.5 released to Amazon Linux 2/2023, Enterprise Linux 7–10, Fedora 43/44, and SLES 16.Key generation and rotation for Encrypted Client Hello (ECH, RFC 9849).
Did you know? ECH encrypts the entire TLS handshake, hiding the Server Name Indication (SNI) from network observers.
- **telegram-desktop**
7.1.5 released to Amazon Linux 2/2023, Enterprise Linux 7–10, Fedora 43/44, and SLES 16.Official Telegram messaging app for Linux desktop.
Did you know? Telegram's MTProto protocol was designed by Nikolai Durov, brother of founder Pavel Durov.
- **nginx-module-media-framework**
1.31.5+2.1.0 released to Amazon Linux 2/2023, Enterprise Linux 7–10, Fedora 43/44, and SLES 16.Distributed framework for live video streaming.
Did you know? This module supports adaptive bitrate streaming, letting viewers automatically get the best quality for their connection.
- **nginx-module-brotli**
1.31.5+0.1.4 released to Amazon Linux 2/2023, Enterprise Linux 7–10, Fedora 43/44, and SLES 16.Brotli compression dynamic modules for NGINX.
Did you know? Brotli was developed by Google and can compress text up to 20% better than gzip.
- **nginx-module-waf**
1.31.5+6.1.10 released to Amazon Linux 2/2023, Enterprise Linux 7–10, Fedora 43/44, and SLES 16.Web application firewall module for NGINX.
Did you know? A WAF can block SQL injection, XSS, and other OWASP Top 10 attacks before they reach your application.
- **nginx-module-security**
1.31.5+1.0.4 released to Amazon Linux 2/2023, Enterprise Linux 7–10, Fedora 43/44, and SL🚀 **Fresh updates from GetPageSpeed**
- nginx
High-performance HTTP and reverse proxy server.
Did you know? nginx is used by over 30% of the world's busiest websites.
- nginx-ech
Key generation and rotation for Encrypted Client Hello (ECH, RFC 9849).
Did you know? ECH encrypts the SNI field, preventing ISPs from seeing which website you visit.
- freenginx
Community-driven fork of nginx, focused on openness and transparency.
Did you know? freenginx was created by nginx's original author, Igor Sysoev.
- freenginx-ech
ECH key generation and rotation for freenginx.
Did you know? ECH is a successor to TLS 1.3's encrypted handshake extensions.
- firewalld-ipset-aws-v4
Amazon Web Services IPv4 ranges for firewalld.
Did you know? AWS publishes its IP ranges as a JSON file, updated daily.
- firewalld-ipset-aws-v6
Amazon Web Services IPv6 ranges for firewalld.
Did you know? IPv6 adoption continues to grow, with AWS supporting dual-stack networking.
- nginx-iplist-aws-v4
NGINX IP list configuration for AWS IPv4 ranges.
Did
- nginx
1.31.5 released to Amazon Linux 2/2023, Enterprise Linux 7–10, Fedora 43/44, and SLES 16.High-performance HTTP and reverse proxy server.
Did you know? nginx is used by over 30% of the world's busiest websites.
- nginx-ech
1.31.5 released to Amazon Linux 2/2023, Enterprise Linux 7–10, Fedora 43/44, and SLES 16.Key generation and rotation for Encrypted Client Hello (ECH, RFC 9849).
Did you know? ECH encrypts the SNI field, preventing ISPs from seeing which website you visit.
- freenginx
1.31.4 released to Amazon Linux 2/2023, Enterprise Linux 7–10, Fedora 43/44, and SLES 16.Community-driven fork of nginx, focused on openness and transparency.
Did you know? freenginx was created by nginx's original author, Igor Sysoev.
- freenginx-ech
1.31.4 released to Amazon Linux 2/2023, Enterprise Linux 7–10, Fedora 43/44, and SLES 16.ECH key generation and rotation for freenginx.
Did you know? ECH is a successor to TLS 1.3's encrypted handshake extensions.
- firewalld-ipset-aws-v4
20260904 released to Amazon Linux 2/2023, Enterprise Linux 7–10, Fedora 43/44, and SLES 16.Amazon Web Services IPv4 ranges for firewalld.
Did you know? AWS publishes its IP ranges as a JSON file, updated daily.
- firewalld-ipset-aws-v6
20260904 released to Amazon Linux 2/2023, Enterprise Linux 7–10, Fedora 43/44, and SLES 16.Amazon Web Services IPv6 ranges for firewalld.
Did you know? IPv6 adoption continues to grow, with AWS supporting dual-stack networking.
- nginx-iplist-aws-v4
20260904 released to Amazon Linux 2/2023, Enterprise Linux 7–10, Fedora 43/44, and SLES 16.NGINX IP list configuration for AWS IPv4 ranges.
Did
🚀 **Fresh updates from GetPageSpeed**
- telegram-desktop
A messaging app focused on speed and security.
Did you know? Telegram's MTProto protocol was designed by the brothers Nikolai and Pavel Durov, with security audits by independent experts.
- gvisor
An application kernel written in Go that provides a secure sandbox for running untrusted code.
Did you know? gVisor runs in userspace, intercepting syscalls without needing hardware virtualization, making it lightweight and portable.
- shairport-sync
Emulates an AirPort Express to stream audio from Apple devices to your Linux box.
Did you know? Shairport-Sync can output to multiple devices simultaneously, including AirPlay 1 and 2, plus legacy AirTunes.
- shairport-sync-firewalld
FirewallD integration files for Shairport Sync.
Did you know? This package ensures your firewall doesn't block AirPlay traffic, so your speakers just work.
- sw-nginx-module-lua
Embeds Lua scripting power directly into Nginx HTTP servers.
Did you know? With ngx_lua, you can write complex request handling logic in Lua without leaving your Nginx config.
- sw-nginx-module-array-var
Adds array-typed variable support to Nginx configuration files.
Did you know? This module lets you iterate over lists in Nginx, making configs far more dynamic.
- sw-nginx-module-captcha
Generates and validates CAPT
- telegram-desktop
7.2.5 released to Amazon Linux 2/2023, Enterprise Linux 7–10, Fedora 43/44, and SUSE Linux Enterprise 16.A messaging app focused on speed and security.
Did you know? Telegram's MTProto protocol was designed by the brothers Nikolai and Pavel Durov, with security audits by independent experts.
- gvisor
20260831.0 released to Amazon Linux 2023, Enterprise Linux 8–10, and Fedora 43/44.An application kernel written in Go that provides a secure sandbox for running untrusted code.
Did you know? gVisor runs in userspace, intercepting syscalls without needing hardware virtualization, making it lightweight and portable.
- shairport-sync
5.5 released to Amazon Linux 2023, Enterprise Linux 7–10, Fedora 43/44, and SUSE Linux Enterprise 16.Emulates an AirPort Express to stream audio from Apple devices to your Linux box.
Did you know? Shairport-Sync can output to multiple devices simultaneously, including AirPlay 1 and 2, plus legacy AirTunes.
- shairport-sync-firewalld
5.5 released to Amazon Linux 2023, Enterprise Linux 7–10, Fedora 43/44, and SUSE Linux Enterprise 16.FirewallD integration files for Shairport Sync.
Did you know? This package ensures your firewall doesn't block AirPlay traffic, so your speakers just work.
- sw-nginx-module-lua
1.30.4+0.10.31+0.3.4 released to Enterprise Linux 7–9.Embeds Lua scripting power directly into Nginx HTTP servers.
Did you know? With ngx_lua, you can write complex request handling logic in Lua without leaving your Nginx config.
- sw-nginx-module-array-var
1.30.4+0.6+0.3.4 released to Enterprise Linux 7–9.Adds array-typed variable support to Nginx configuration files.
Did you know? This module lets you iterate over lists in Nginx, making configs far more dynamic.
- sw-nginx-module-captcha
1.30.4+0.0.1 released to Enterprise Linux 7–9.Generates and validates CAPT
NGINX RADIUS Authentication: No More htpasswd Files
Stock NGINX cannot talk to RADIUS. The nginx-module-auth-radius package adds RFC 2865 authentication with multi-server failover, verified end to end against FreeRADIUS, including the BlastRADIUS compatibility gotcha.
#Authentication, #NginxModules, #Radius, #Security
Stock NGINX cannot talk to RADIUS. The nginx-module-auth-radius package adds RFC 2865 authentication with multi-server failover, verified end to end against FreeRADIUS, including the BlastRADIUS compatibility gotcha.
#Authentication, #NginxModules, #Radius, #Security
NGINX TLS Vulnerability Fixes: BREACH, SWEET32, ROBOT
One directive, ssl_protocols TLSv1.3;, eliminates ROBOT, SWEET32 and Lucky13 outright. BREACH survives in HTTP compression and needs a scoped gzip off. Every fix runtime-tested, plus the post-quantum step beyond.
#ContentShapeError, #TargetTierPro, #Tls
One directive, ssl_protocols TLSv1.3;, eliminates ROBOT, SWEET32 and Lucky13 outright. BREACH survives in HTTP compression and needs a scoped gzip off. Every fix runtime-tested, plus the post-quantum step beyond.
#ContentShapeError, #TargetTierPro, #Tls
NGINX proxy_pass: URI Rewriting, Variables, and DNS Gotchas
The exact proxy_pass URI rewriting rules, variable resolution gotchas, and three verified ways to fix NGINX’s frozen-DNS problem, including the upstream-jdomain module.
#Dns, #Nginx, #ProxyPass, #ReverseProxy, #Upstream
The exact proxy_pass URI rewriting rules, variable resolution gotchas, and three verified ways to fix NGINX’s frozen-DNS problem, including the upstream-jdomain module.
#Dns, #Nginx, #ProxyPass, #ReverseProxy, #Upstream
👍1
NGINX Directive Execution Order: The 11 Request Phases
How NGINX directive execution order really works: the 11 request phases, why return beats deny, why a server rewrite changes your location, and where third-party directives run. Every example curl-verified.
#Lua, #Nginx, #NginxConfiguration, #NginxModules, #Rewrite
How NGINX directive execution order really works: the 11 request phases, why return beats deny, why a server rewrite changes your location, and where third-party directives run. Every example curl-verified.
#Lua, #Nginx, #NginxConfiguration, #NginxModules, #Rewrite
ECH Without Padding Is a Lookup Table
ECH hides the SNI, yet every vhost we measured, 8 of 8 in the lab and 5 of 5 in production, was identifiable from server handshake record sizes alone. Here is the measured leak, and the one-directive NGINX module that closes it.
#Ech, #EncryptedClientHello, #Fingerprinting, #Nginx, #Openssl, #Privacy, #Security, #Tls
ECH hides the SNI, yet every vhost we measured, 8 of 8 in the lab and 5 of 5 in production, was identifiable from server handshake record sizes alone. Here is the measured leak, and the one-directive NGINX module that closes it.
#Ech, #EncryptedClientHello, #Fingerprinting, #Nginx, #Openssl, #Privacy, #Security, #Tls
❤1👍1