Re: Blocking unknown hostnames for SSL/TLS connections

2015-12-03 Thread Patrick O'Brien
On Thu, Dec 3, 2015 at 1:44 PM, Valentin V. Bartenev wrote: > On Thursday 03 December 2015 11:41:51 Patrick O'Brien wrote: >> Hello, >> >> We're currently using nginx for SSL/TLS termination, which then >> proxies the request to a pair of internal pair of load balancers. >> Since the TLS handshake

Re: *14177278 readv() failed (104: Connection reset by peer) while reading upstream

2015-12-03 Thread B.R.
Beware the observation bias. Maybe try going back to v1.6.2 (or v1.6.3 for the latest 1.6)? These messages indicates the remote side resets the connection, not nginx, thus your PHP-FPM is responsible for that. Why? Ask it :o) --- *B. R.* On Fri, Dec 4, 2015 at 12:58 AM, silentmiles wrote: > I h

Re: *14177278 readv() failed (104: Connection reset by peer) while reading upstream

2015-12-03 Thread silentmiles
I have also started to see these errors in my log -- readv() failed (104: Connection reset by peer). I recently upgraded from nginx 1.6.2 to 1.8, and I think they started from this point. This is with a Linux/PHP-FPM setup. I've found a few mentions of the above error with this setup, but they're

Re: SPDY + HTTP/2

2015-12-03 Thread CJ Ess
Let me get back to you on that - we're going to send some traffic through Cloudflare and see how the traffic breaks out given the choice of all three protocols. On Thu, Dec 3, 2015 at 1:29 PM, Maxim Konovalov wrote: > Hello, > > On 12/3/15 9:14 PM, CJ Ess wrote: > > NGINX devs, > > > > I know yo

Re: Blocking unknown hostnames for SSL/TLS connections

2015-12-03 Thread Valentin V. Bartenev
On Thursday 03 December 2015 11:41:51 Patrick O'Brien wrote: > Hello, > > We're currently using nginx for SSL/TLS termination, which then > proxies the request to a pair of internal pair of load balancers. > Since the TLS handshake is performed before nginx is able to figure > out what hostname is

Blocking unknown hostnames for SSL/TLS connections

2015-12-03 Thread Patrick O'Brien
Hello, We're currently using nginx for SSL/TLS termination, which then proxies the request to a pair of internal pair of load balancers. Since the TLS handshake is performed before nginx is able to figure out what hostname is being requested, except in cases where SNI is used, it will accept any r

Re: SPDY + HTTP/2

2015-12-03 Thread Maxim Konovalov
Hello, On 12/3/15 9:14 PM, CJ Ess wrote: > NGINX devs, > > I know you were very excited to remove SPDY support from NGINX, but > for the next few years there are a lot of devices (mobile devices > that can't upgrade, end users who aren't comfortable upgrading, etc) > that are not going to have ht

SPDY + HTTP/2

2015-12-03 Thread CJ Ess
NGINX devs, I know you were very excited to remove SPDY support from NGINX, but for the next few years there are a lot of devices (mobile devices that can't upgrade, end users who aren't comfortable upgrading, etc) that are not going to have http/2 support. By removing SPDY support you've created

Re: Could Nginx stream support FTP PASSIVE?

2015-12-03 Thread Richard Stanway
Passive ports are dynamically allocated, so FTP with the stream module is unlikely to work at all. On Thu, Dec 3, 2015 at 7:10 AM, Felix HT1 Zhang wrote: > Dears, > > Could Nginx stream support FTP PASSIVE? > > > > #er nobody; > > worker_processes 4; > > > > #error_log logs/error.log; > > #er

Re: SSL handshake issue !!

2015-12-03 Thread itpp2012
https://www.ruby-forum.com/topic/6873127 http://serverfault.com/questions/663290/in-nginx-error-log-ssl-bytes-to-cipher-listinappropriate-fallback http://stackoverflow.com/questions/28010492/nginx-critical-error-with-ssl-handshaking Posted at Nginx Forum: https://forum.nginx.org/read.php?2,263236

SSL handshake issue !!

2015-12-03 Thread shahzaib shahzaib
Hi, We've been encountering this issue quiet frequently. Looks like that is the reason of our drop in traffic as well. 2015/12/03 16:19:18 [crit] 26272#0: *176263213 SSL_do_handshake() failed (SSL: error:140A1175:SSL routines:SSL_BYTES_TO_CIPHER_LIST:inappropriate fallback) while SSL handshaki

Re: server_name within tcp server blocks

2015-12-03 Thread Charles Nnamdi Akalugwu
Thanks a lot for the clarification guys! :) On Wed, Dec 2, 2015 at 7:46 PM, itpp2012 wrote: > Richard Stanway Wrote: > --- > > TCP has no concept of server names, so this is not possible. It only > > works > > in HTTP because the client sends