Nginx + LibreSSL

With the release of the version 2.0.2 of LibreSSL I wanted to use it on one of my Nginx server to see if it’s possible to make them work together. After all OpenBSD’s dev said that it’s a “drop-in” replacement.

I followed the great post here Nginx + LibreSSL – a first test. And using an already existing script to build the last version of Nginx + OpenSSL, I created my gist to do the same thing with LibreSSL :

#!/usr/bin/env bash # names of latest versions of each package export NGINX_VERSION=1.15.5 export VERSION_NGINX=nginx-$NGINX_VERSION export VERSION_LIBRESSL=libressl-2.8.1 export VERSION_PCRE=pcre-8.42 #export NPS_VERSION=1.9.32.10 #export VERSION_PAGESPEED=v${NPS_VERSION}-beta # URLs to the source directories export SOURCE_LIBRESSL=https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/ export SOURCE_PCRE=ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/ export SOURCE_NGINX=http://nginx.org/download/ #export SOURCE_RTMP=https://github.com/arut/nginx-rtmp-module.git #export SOURCE_PAGESPEED=https://github.com/pagespeed/ngx_pagespeed/archive/ # clean out any files from previous runs of this script rm -rf build mkdir build # proc for building faster NB_PROC=$(grep -c ^processor /proc/cpuinfo) # ensure that we have the required software to compile our own nginx sudo apt-get -y install curl wget build-essential libgd-dev libgeoip-dev checkinstall git # grab the source files echo "Download sources" wget -P ./build $SOURCE_PCRE$VERSION_PCRE.tar.gz wget -P ./build $SOURCE_LIBRESSL$VERSION_LIBRESSL.tar.gz wget -P ./build $SOURCE_NGINX$VERSION_NGINX.tar.gz #wget -P ./build $SOURCE_PAGESPEED$VERSION_PAGESPEED.tar.gz #wget -P ./build https://dl.google.com/dl/page-speed/psol/${NPS_VERSION}.tar.gz git clone $SOURCE_RTMP ./build/rtmp # expand the source files echo "Extract Packages" cd build tar xzf $VERSION_NGINX.tar.gz tar xzf $VERSION_LIBRESSL.tar.gz tar xzf $VERSION_PCRE.tar.gz #tar xzf $VERSION_PAGESPEED.tar.gz #tar xzf ${NPS_VERSION}.tar.gz -C ngx_pagespeed-${NPS_VERSION}-beta cd ../ # set where LibreSSL and nginx will be built export BPATH=$(pwd)/build export STATICLIBSSL=$BPATH/$VERSION_LIBRESSL # build static LibreSSL echo "Configure & Build LibreSSL" cd $STATICLIBSSL ./configure LDFLAGS=-lrt --prefix=${STATICLIBSSL}/.openssl/ && make install-strip -j $NB_PROC # build nginx, with various modules included/excluded echo "Configure & Build Nginx" cd $BPATH/$VERSION_NGINX #echo "Download and apply path" #wget -q -O - $NGINX_PATH | patch -p0 mkdir -p $BPATH/nginx ./configure --with-openssl=$STATICLIBSSL \ --with-ld-opt="-lrt" \ --sbin-path=/usr/sbin/nginx \ --conf-path=/etc/nginx/nginx.conf \ --error-log-path=/var/log/nginx/error.log \ --http-log-path=/var/log/nginx/access.log \ --with-pcre=$BPATH/$VERSION_PCRE \ --with-http_ssl_module \ --with-http_v2_module \ --with-file-aio \ --with-ipv6 \ --with-http_gzip_static_module \ --with-http_stub_status_module \ --without-mail_pop3_module \ --without-mail_smtp_module \ --without-mail_imap_module \ --with-http_image_filter_module \ --lock-path=/var/lock/nginx.lock \ --pid-path=/run/nginx.pid \ --http-client-body-temp-path=/var/lib/nginx/body \ --http-fastcgi-temp-path=/var/lib/nginx/fastcgi \ --http-proxy-temp-path=/var/lib/nginx/proxy \ --http-scgi-temp-path=/var/lib/nginx/scgi \ --http-uwsgi-temp-path=/var/lib/nginx/uwsgi \ --with-debug \ --with-pcre-jit \ --with-http_stub_status_module \ --with-http_realip_module \ --with-http_auth_request_module \ --with-http_addition_module \ --with-http_geoip_module \ --with-http_gzip_static_module # --add-module=$BPATH/rtmp #--add-module=$BPATH/ngx_pagespeed-${NPS_VERSION}-beta touch $STATICLIBSSL/.openssl/include/openssl/ssl.h make -j $NB_PROC && sudo checkinstall --pkgname="nginx-libressl" --pkgversion="$NGINX_VERSION" \ --provides="nginx" --requires="libc6, libpcre3, zlib1g" --strip=yes \ --stripso=yes --backup=yes -y --install=yes echo "All done."; echo "This build has not edited your existing /etc/nginx directory."; echo "If things aren't working now you may need to refer to the"; echo "configuration files the new nginx ships with as defaults,"; echo "which are available at /etc/nginx-default";

Quite amazing how easy it was, and here I am with a Raspberry Pi and Nginx 1.7.3 + libreSSL, it’s working perfectly and flawlessly.

My journey in the computer world

Antoine Aflalo

Leave a Reply Cancel reply

Antoine Aflalo

My journey in the computer world

Nginx + LibreSSL

Antoine Aflalo

Leave a Reply Cancel reply

Popular Post

Antoine Aflalo