Make SSL boring again
Dec 6, 2017Alessandro Ghedini
Summary
This post details Cloudflare's migration of its edge SSL connection termination stack to BoringSSL. This move enabled support for TLS 1.3 across the board, improved key negotiation with X25519 for TLS 1.2 and earlier, and introduced RSA-PSS for TLS 1.2. It also highlights internal improvements to features like Keyless SSL, distributed session ID caches, and cipher grouping, as well as the development of a more reliable OCSP stapling pipeline. The post also touches on addressing performance issues with base64 decoding in BoringSSL and maintaining support for legacy ChaCha20-Poly1305 ciphers for older clients.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack