{"id":17084613,"url":"https://github.com/fleshgrinder/nginx-session-ticket-key-rotation","last_synced_at":"2025-04-12T21:25:31.301Z","repository":{"id":21495477,"uuid":"24814390","full_name":"Fleshgrinder/nginx-session-ticket-key-rotation","owner":"Fleshgrinder","description":"Nginx session ticket key rotation program for secure rotation of TLS session ticket keys and sharing in server clusters.","archived":false,"fork":false,"pushed_at":"2015-05-29T18:10:22.000Z","size":324,"stargazers_count":23,"open_issues_count":0,"forks_count":2,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-03-26T15:42:31.200Z","etag":null,"topics":["nginx","nginx-configuration","shell","ssl","tls","tls-session-ticket-keys","tls-session-tickets"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"unlicense","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Fleshgrinder.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2014-10-05T11:30:22.000Z","updated_at":"2022-03-31T02:10:50.000Z","dependencies_parsed_at":"2022-08-17T18:00:34.067Z","dependency_job_id":null,"html_url":"https://github.com/Fleshgrinder/nginx-session-ticket-key-rotation","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Fleshgrinder%2Fnginx-session-ticket-key-rotation","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Fleshgrinder%2Fnginx-session-ticket-key-rotation/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Fleshgrinder%2Fnginx-session-ticket-key-rotation/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Fleshgrinder%2Fnginx-session-ticket-key-rotation/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Fleshgrinder","download_url":"https://codeload.github.com/Fleshgrinder/nginx-session-ticket-key-rotation/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248633299,"owners_count":21136851,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["nginx","nginx-configuration","shell","ssl","tls","tls-session-ticket-keys","tls-session-tickets"],"created_at":"2024-10-14T13:08:03.780Z","updated_at":"2025-04-12T21:25:31.272Z","avatar_url":"https://github.com/Fleshgrinder.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# nginx session ticket key rotation\n[nginx](http://nginx.org/) session ticket key rotation program for secure\nrotation of TLS session ticket keys and sharing in server clusters.\n\nThis program was developed as part of my Master's thesis at the\n[Fachhochschule Salzburg](https://github.com/fh-salzburg). I hope to release my\nthesis with an open license as soon as possible. You'll find much more details\non TLS, its performance, and this program in there. Although I aim to provide a\ncomplete documentation for it here, I currently don't have the time to write it\nup because (you guessed) I'm working on the thesis. Feel free to open an issue\nif you have questions or found a bug.\n\n## Usage\nYou should clone the repository to a place were it can stay. The files are\nneeded and shouldn't be deleted. The best place is `/etc` as illustrated in the\nfollowing example.\n\n```\ncd /etc\ngit clone https://github.com/Fleshgrinder/nginx-session-ticket-key-rotation.git\nsh nginx-session-ticket-key-rotation/install.sh example.com localhost\n```\n\nThis would install TLS session ticket rotation for `example.com` and `localhost`.\nYou have to edit your nginx configuration yourself afterwards, a minimal\nconfiguration with the default ticket lifetime of my installation for `localhost`\nwould look like the following example.\n\n```\nhttp {\n  server {\n    listen                     443 ssl;\n    server_name                localhost;\n    ssl_certificate            cert.pem;\n    ssl_certificate_key        cert.key;\n    ssl_ciphers                HIGH:!aNULL:!MD5;\n    ssl_prefer_server_ciphers  on;\n    ssl_session_timeout        24h;\n    ssl_session_ticket_key     /mnt/session_ticket_keys/localhost.1.key;\n    ssl_session_ticket_key     /mnt/session_ticket_keys/localhost.2.key;\n    ssl_session_ticket_key     /mnt/session_ticket_keys/localhost.3.key;\n  }\n}\n```\n\nTo uninstall the rotation mechanism simply execute the `uninstall.sh` script.\n\n```\nsh nginx-session-ticket-key-rotation/uninstall.sh\n```\n\n### Server Names\nYou have to supply the server names (domains) to the installation script, this\nis important because you should only use a ticket key on a per host basis.\nYou'll open your servers to various attacks (e.g. [5](#references)) if you share\na keys among several hosts. The server names are also used to generate the key\nfile names, which makes it easier for you to know which ticket belongs to which\nserver.\n\n*Note* that there are situations where you want to share keys among several\nhosts. But I warned you, this is something that you should only attempt if you\nabsolutely understand the potential risks and what it can be good for!\n\n### Tests\nThe repository includes unit tests for most functions and an integration test.\nTo run the test either execute them separately (have a look at the test\ndirectory) or by issuing `make test`.\n\nYou can safely delete the test directory if you don't want to waste disk space.\n\n### Coding Standard\nThe program should be as POSIX compliant as possible and everything was tested\nwith the dash interpreter. Note that I prefer to use quotes around most strings\nbecause developers are used to do so in almost all other languages. Also note\nthat there is a special dash bug related to closing `stdout` which is why I had\nto redirect `stdout` to `/dev/null` instead of directly closing it. The return\nvalues are always documented for each function, often that returned value is\nimplicit returned by another called function. So you won't find a `return`\nstatement in each function.\n\nThe best place for information on POSIX is [The Open Group Base Specifications]\n(http://pubs.opengroup.org/onlinepubs/9699919799/nframe.html).\n\n### TODO\n- Better error handling with a proper exit handler instead of `set -e` that\n  gives a hint what actually went wrong.\n- Unit tests with [shUnit2](https://code.google.com/p/shunit2/).\n- Tell users to install something for better random numbers (esp. VPS), see\n  [Havege](https://www.irisa.fr/caps/projects/hipsor/)\n  ([`haveged`](https://packages.debian.org/wheezy/haveged)).\n- Tell users to test their random numbers\n  ([`rngtest`](https://github.com/waitman/rngtest))?\n- Create slave program for clusters.\n- Install ntp daemon right away if none was found?\n- Test with other operating systems (currently only Debian tested).\n\n## License\n\u003e This is free and unencumbered software released into the public domain.\n\u003e\n\u003e For more information, please refer to \u003chttp://unlicense.org\u003e\n\n## References\n1. Joseph Salowey, Harry Zhou, Pasi Eronen and Hannes Tschofenig:\n  “[RFC 5077](https://tools.ietf.org/html/rfc5077)”, January, 2008.\n2. Jacob Hoffman-Andrews: “[Forward Secrecy at Twitter]\n   (https://blog.twitter.com/2013/forward-secrecy-at-twitter)”, November 22th, 2013.\n3. Adam Langley: “[How to botch TLS forward secrecy]\n   (https://www.imperialviolet.org/2013/06/27/botchingpfs.html)”, July 27th, 2013.\n4. Jacob Hoffman-Andrews: “[How to check for TLS ticket key rotation]\n   (https://jacob.hoffman-andrews.com/README/how-to-check-for-tls-ticket-key-rotation/)”, December 5th, 2013.\n5. Antoine Delignat-Lavaud and Karthikeyan Bhargavan:\n   “[Virtual Host Confusion: Weaknesses and Exploits]\n   (https://www.blackhat.com/docs/us-14/materials/us-14-Delignat-The-BEAST-Wins-Again-Why-TLS-Keeps-Failing-To-Protect-HTTP-wp.pdf)”, August, 2014.\n\n## Weblinks\nOther repositories of interest:\n- [nginx-configuration](https://github.com/Fleshgrinder/nginx-configuration)\n- [nginx-compile](https://github.com/Fleshgrinder/nginx-compile)\n- [nginx-sysvinit-script](https://github.com/Fleshgrinder/nginx-sysvinit-script)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffleshgrinder%2Fnginx-session-ticket-key-rotation","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffleshgrinder%2Fnginx-session-ticket-key-rotation","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffleshgrinder%2Fnginx-session-ticket-key-rotation/lists"}