Thank you for clarification. Regard Aleks
-------- Ursprüngliche Nachricht -------- Von: Adam Langley <a...@imperialviolet.org> Gesendet: 21. Jänner 2019 00:12:59 MEZ An: Aleksandar Lazic <al-hapr...@none.at> CC: haproxy@formilux.org, Willy Tarreau <w...@1wt.eu>, eb...@haproxy.com Betreff: Re: HAProxy with OpenSSL 1.1.1 breaks when TLS 1.3 KeyUpdate is used. On Sun, Jan 20, 2019 at 3:04 PM Aleksandar Lazic <al-hapr...@none.at> wrote: > which refers to > https://www.openssl.org/docs/manmaster/man3/SSL_key_update.html > > instead of the suggested Patch? The SSL_key_update function enqueues a KeyUpdate message to be sent. The problem is that if a /client/ of HAProxy sends a KeyUpdate, HAProxy thinks that it's a pre-TLS 1.3 renegotiation message and drops the connection. Thus the patch seeks to address that. HAProxy may also want to do something like send a KeyUpdate for every x MBs of data sent, or y minutes of time elapsed, but that would be a separate feature. (And one needs to be a little cautious because OpenSSL 1.1.1 will only accept 32 KeyUpdate messages per connection.) Cheers AGL
