Re: need help reverse-proxy config

2017-01-10 Thread Thierry
seems to be link to my ssl certificate ... Posted at Nginx Forum: https://forum.nginx.org/read.php?2,271891,271919#msg-271919 ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: CRL validation

2017-01-10 Thread Alex Samad
Hi I have a cron script that generates a crl file and places it a file for nginx to read... I believe I reload nginx after doing this I don't think - happy to be proved wrong - that nginx checks for a oscp or crl attribute in the cert and makes the relevant request Alex On 11 January 2017 at 03

Re: Nginx not honoring keepalive / multiple requests to http backend over single TCP session

2017-01-10 Thread Richard Stanway
The FIN ACK suggests that the other side is responsible for closing the connection. If nginx was terminating the connection, there would be no ACK bit set. Check your upstream server supports keepalive. On Tue, Jan 10, 2017 at 10:55 PM, Jonathan Geyser wrote: > Hi guys, > > I'm attempting to hav

Nginx not honoring keepalive / multiple requests to http backend over single TCP session

2017-01-10 Thread Jonathan Geyser
Hi guys, I'm attempting to have multiple requests to a backend reuse the same TCP session as to avoid handshaking for each subsequent request. Nginx appears to send FIN ACK to the backend after every request. Am I doing something wrong? Here is the current configuration: https://paste.ngx.cc/6c2

Rewrite

2017-01-10 Thread vegetax
Hi need some help I am load balancing my syslog traffic from my WAF device to ngix server below and the servers in the pool are servers running rsyslog currently the issue is when the logs hit the nginx server it re-writes the source host name for example below in logs you see "nginx_vm" but you

Re: upstream timeouts I can not explain

2017-01-10 Thread Peter Booth
All hosts have characteristic stalls and blips but the scale of this issue can vary 100x depending on is configuration. You can get some data about these stalls using solar flare's sysjitter utility or Gil Tene's jhiccup. Sent from my iPhone On Jan 10, 2017, at 12:46 PM, Руслан Закиров wrote:

Re: upstream timeouts I can not explain

2017-01-10 Thread Руслан Закиров
> > > > The "upstream timeout ... while connecting to upstream" suggests > > > that nginx wasn't able to see the connect event. > > > > > > [...] > > > > > > Some things to consider: > > > > > > - Make sure you are looking at tcpdump on the nginx host, and > > > there are no firewalls on the host

CRL validation

2017-01-10 Thread woodyweaver
I need to use nginx with client validation. Lots of good info about that. But I need to ensure that nginx verifies the certificate has not been revoked through CRL or OCSP checking. Is that part of ssl_verify_client on ? How can I specify a cached CRL location? --woody Posted at Nginx Forum:

Re: need help reverse-proxy config

2017-01-10 Thread Thierry
I am still debugging a bit: 2017/01/10 18:17:59 [debug] 5174#5174: accept mutex lock failed: 0 2017/01/10 18:17:59 [debug] 5174#5174: epoll timer: 500 2017/01/10 18:17:59 [debug] 5172#5172: epoll: fd:13 ev:0005 d:7F81B6D351D0 2017/01/10 18:17:59 [debug] 5172#5172: *1 http keepalive handler 201

Re: stream module on 100% cpu load

2017-01-10 Thread Vladimir Homutov
03.01.2017 16:20, A. Schulze пишет: > > Hello, > > last days I setup a server to encapsulate DNS over TLS. > >- DNS-Server @localhost, Port 53 TCP >- NGINX Stream module on public IP, Port 853 TCP, SSL enabled. > > That work so far. > Now I thought to scan this setup using ssllabs.com >