Skip to content

Add support of TLS 1.3 #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
blackbearman merged 2 commits into from
Apr 9, 2026
Merged

Add support of TLS 1.3 #27

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d1ca0d5
Add nginx settings for new ciphers
blackbearman Dec 20, 2025
1980cb5
Add support for OpenSSL 3.5.5
blackbearman Apr 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion client/build_client.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ gsettings-desktop-schemas-dev ca-certificates -y

git clone https://github.com/bcrypto/bee2evp.git
cd bee2evp
bash scripts/build.sh -s -b -t openssl-3.3.1
bash scripts/build.sh -s -b openssl-3.5.5
cd ..

export PREFIX=${PWD}/bee2evp/build/local
Expand Down
1 change: 1 addition & 0 deletions client/run_client.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,5 +5,6 @@ export LD_LIBRARY_PATH=${PREFIX}/lib:${LD_LIBRARY_PATH}
export PATH=${PREFIX}/bin:${PATH}
export OPENSSL_CONF=${PREFIX}/openssl.cnf
export GIO_MODULE_DIR=${PREFIX}/lib/x86_64-linux-gnu/gio/modules
export G_TLS_OPENSSL_CIPHER_LIST=BTLS_BASH_PRG_AE256_BASH256:BTLS_BELT_CHE256_BELT_HASH:DHE-BIGN-WITH-BELT-CTR-MAC-HBELT:DHE-BIGN-WITH-BELT-DWP-HBELT:DHT-BIGN-WITH-BELT-CTR-MAC-HBELT:DHT-BIGN-WITH-BELT-DWP-HBELT

epiphany $1
15 changes: 8 additions & 7 deletions server/btls256/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,19 +14,19 @@ RUN apt-get install -y -q \
patch \
cmake

COPY ./nginx.sh ./
COPY ./index.html /etc/nginx/html/index.html
COPY ./priv256.key /etc/nginx/ssl/priv256.key
COPY ./cert256.pem /etc/nginx/ssl/cert256.pem
COPY ./nginx.conf /etc/nginx/nginx.conf
ENV HOME /root
WORKDIR $HOME

RUN git clone https://github.com/bcrypto/bee2evp.git
WORKDIR $HOME/bee2evp
RUN BEE2EVP_INSTALL_DIR=/opt/usr/local bash scripts/build.sh -s -b -t openssl-3.3.1
RUN BEE2EVP_INSTALL_DIR=/opt/usr/local bash scripts/build.sh -s -b openssl-3.5.5

WORKDIR '/'
COPY ./nginx.sh ./
COPY ./index.html /etc/nginx/html/index.html
COPY ./priv256.key /etc/nginx/ssl/priv.key
COPY ./cert256.pem /etc/nginx/ssl/cert.pem
COPY ./nginx.conf /etc/nginx/nginx.conf
RUN bash ./nginx.sh

WORKDIR $HOME
Expand All @@ -38,4 +38,5 @@ EXPOSE 8443
EXPOSE 8444
EXPOSE 8445
EXPOSE 8446

EXPOSE 8447
EXPOSE 8448
65 changes: 54 additions & 11 deletions server/btls256/nginx.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,13 +56,14 @@ http {
listen 443 ssl;
server_name localhost;
add_header Strict-Transport-Security 'max-age=31536000' always;
ssl_certificate /etc/nginx/ssl/cert256.pem;
ssl_certificate_key /etc/nginx/ssl/priv256.key;
ssl_certificate /etc/nginx/ssl/cert.pem;
ssl_certificate_key /etc/nginx/ssl/priv.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_prefer_server_ciphers on;
ssl_ciphers DHE-BIGN-WITH-BELT-CTR-MAC-HBELT:DHE-BIGN-WITH-BELT-DWP-HBELT:DHT-BIGN-WITH-BELT-CTR-MAC-HBELT:DHT-BIGN-WITH-BELT-DWP-HBELT:DHE-PSK-BIGN-WITH-BELT-DWP-HBELT:DHE-PSK-BIGN-WITH-BELT-CTR-MAC-HBELT:DHT-PSK-BIGN-WITH-BELT-DWP-HBELT:DHT-PSK-BIGN-WITH-BELT-CTR-MAC-HBELT;
ssl_protocols TLSv1.2;
ssl_conf_command Ciphersuites TLS_BASH_PRG_AE2561_BASH256:TLS_BELT_CHE256_BELT_HASH;
ssl_protocols TLSv1.2 TLSv1.3;
location /check_server {
proxy_pass http://flask-app:5000;
proxy_set_body "$ssl_cipher#$ssl_ciphers#$ssl_curves#$ssl_protocol";
Expand All @@ -77,8 +78,8 @@ http {
listen 8443 ssl;
server_name localhost;
add_header Strict-Transport-Security 'max-age=31536000' always;
ssl_certificate /etc/nginx/ssl/cert256.pem;
ssl_certificate_key /etc/nginx/ssl/priv256.key;
ssl_certificate /etc/nginx/ssl/cert.pem;
ssl_certificate_key /etc/nginx/ssl/priv.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_prefer_server_ciphers on;
Expand All @@ -98,8 +99,8 @@ http {
listen 8444 ssl;
server_name localhost;
add_header Strict-Transport-Security 'max-age=31536000' always;
ssl_certificate /etc/nginx/ssl/cert256.pem;
ssl_certificate_key /etc/nginx/ssl/priv256.key;
ssl_certificate /etc/nginx/ssl/cert.pem;
ssl_certificate_key /etc/nginx/ssl/priv.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_prefer_server_ciphers on;
Expand All @@ -119,8 +120,8 @@ http {
listen 8445 ssl;
server_name localhost;
add_header Strict-Transport-Security 'max-age=31536000' always;
ssl_certificate /etc/nginx/ssl/cert256.pem;
ssl_certificate_key /etc/nginx/ssl/priv256.key;
ssl_certificate /etc/nginx/ssl/cert.pem;
ssl_certificate_key /etc/nginx/ssl/priv.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_prefer_server_ciphers on;
Expand All @@ -140,8 +141,8 @@ http {
listen 8446 ssl;
server_name localhost;
add_header Strict-Transport-Security 'max-age=31536000' always;
ssl_certificate /etc/nginx/ssl/cert256.pem;
ssl_certificate_key /etc/nginx/ssl/priv256.key;
ssl_certificate /etc/nginx/ssl/cert.pem;
ssl_certificate_key /etc/nginx/ssl/priv.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers DHT-BIGN-WITH-BELT-DWP-HBELT;
Expand All @@ -156,6 +157,48 @@ http {
}
}

server {
listen 8447 ssl;
server_name localhost;
add_header Strict-Transport-Security 'max-age=31536000' always;
ssl_certificate /etc/nginx/ssl/cert.pem;
ssl_certificate_key /etc/nginx/ssl/priv.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers DHT-BIGN-WITH-BELT-DWP-HBELT;
ssl_conf_command Ciphersuites TLS_BASH_PRG_AE2561_BASH256;
ssl_protocols TLSv1.3;
location /check_server {
proxy_pass http://flask-app:5000;
proxy_set_body "$ssl_cipher#$ssl_ciphers#$ssl_curves#$ssl_protocol";
}
location / {
proxy_pass http://flask-app:5000;
proxy_set_body "$ssl_cipher#$ssl_ciphers#$ssl_curves#$ssl_protocol";
}
}

server {
listen 8448 ssl;
server_name localhost;
add_header Strict-Transport-Security 'max-age=31536000' always;
ssl_certificate /etc/nginx/ssl/cert.pem;
ssl_certificate_key /etc/nginx/ssl/priv.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers DHT-BIGN-WITH-BELT-DWP-HBELT;
ssl_conf_command Ciphersuites TLS_BELT_CHE256_BELT_HASH;
ssl_protocols TLSv1.3;
location /check_server {
proxy_pass http://flask-app:5000;
proxy_set_body "$ssl_cipher#$ssl_ciphers#$ssl_curves#$ssl_protocol";
}
location / {
proxy_pass http://flask-app:5000;
proxy_set_body "$ssl_cipher#$ssl_ciphers#$ssl_curves#$ssl_protocol";
}
}

server {
# catch all unsecure requests (both IPv4 and IPv6)
listen 80 default_server;
Expand Down
8 changes: 4 additions & 4 deletions server/btls256/nginx.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,10 +6,10 @@ make
make install
cd ..

wget http://zlib.net/zlib-1.3.1.tar.gz
tar -zxf zlib-1.3.1.tar.gz
wget http://zlib.net/zlib-1.3.2.tar.gz
tar -zxf zlib-1.3.2.tar.gz
ls /
cd zlib-1.3.1
cd zlib-1.3.2
./configure
make
make install
Expand All @@ -21,7 +21,7 @@ tar -zxf nginx-1.29.3.tar.gz
cd nginx-1.29.3
#patch -p1 -i nginx.patch
ls /
./configure --pid-path=/usr/local/nginx/nginx.pid --with-pcre=/pcre-8.45 --with-zlib=/zlib-1.3.1 --with-http_ssl_module --with-stream --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --conf-path=/etc/nginx/nginx.conf --with-ld-opt="-L /opt/usr/local/lib" --with-cc-opt="-I /opt/usr/local/include"
./configure --pid-path=/usr/local/nginx/nginx.pid --with-pcre=/pcre-8.45 --with-zlib=/zlib-1.3.2 --with-http_ssl_module --with-stream --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --conf-path=/etc/nginx/nginx.conf --with-ld-opt="-L /opt/usr/local/lib" --with-cc-opt="-I /opt/usr/local/include"
make
make install
cd ..
42 changes: 3 additions & 39 deletions server/btls384/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,41 +1,5 @@
FROM ubuntu:24.04
FROM btls/btls256

RUN apt-get clean
RUN apt-get update

RUN apt-get install -y -q \
wget \
git \
python3 \
vim \
nano \
iptables \
build-essential \
patch \
cmake

COPY ./nginx.sh ./
COPY ./index.html /etc/nginx/html/index.html
COPY ./priv384.key /etc/nginx/ssl/priv384.key
COPY ./cert384.pem /etc/nginx/ssl/cert384.pem
COPY ./nginx.conf /etc/nginx/nginx.conf
ENV HOME /root
WORKDIR $HOME

RUN git clone https://github.com/bcrypto/bee2evp.git
WORKDIR $HOME/bee2evp
RUN BEE2EVP_INSTALL_DIR=/opt/usr/local bash scripts/build.sh -s -b -t openssl-3.3.1

WORKDIR '/'
RUN bash ./nginx.sh

WORKDIR $HOME
ENV PREFIX /opt/usr/local
ENV LD_LIBRARY_PATH "${PREFIX}/lib:${LD_LIBRARY_PATH:-}"
ENV PATH ${PREFIX}/bin:${PATH}
EXPOSE 443
EXPOSE 8443
EXPOSE 8444
EXPOSE 8445
EXPOSE 8446
COPY ./priv384.key /etc/nginx/ssl/priv.key
COPY ./cert384.pem /etc/nginx/ssl/cert.pem

70 changes: 0 additions & 70 deletions server/btls384/index.html
View file
Open in desktop

This file was deleted.

Loading