Skip to content

Enable OpenSSL QUIC when available - #13468

Merged
bneradt merged 1 commit into
apache:masterfrom
bneradt:enable-openssl-quic-by-default
Jul 31, 2026
Merged

Enable OpenSSL QUIC when available#13468
bneradt merged 1 commit into
apache:masterfrom
bneradt:enable-openssl-quic-by-default

Conversation

@bneradt

@bneradt bneradt commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

OpenSSL 3.5 provides the QUIC implementation ATS needs to accept
HTTP/3 connections from downstream clients. This affects client-to-ATS
traffic, not ATS-to-origin traffic. Requiring an extra opt-in leaves
capable builds without client-facing HTTP/3, but merely compiling QUIC
should not make deployments without QUIC listeners load every TLS
certificate twice.

This makes native OpenSSL QUIC an automatic CMake option. It activates
only with upstream OpenSSL's native server API, remains disabled when
quiche is selected, and preserves explicit ON and OFF overrides.

This also starts the QUIC processor and maintains its certificate
table only when a QUIC listener is configured, avoiding the duplicate
load when HTTP/3 is unused.

Copilot AI review requested due to automatic review settings July 31, 2026 21:07
@bneradt bneradt added this to the 11.0.0 milestone Jul 31, 2026
@bneradt bneradt added Backport Marked for backport for an LTS patch release HTTP/3 CMake work related to CMakes scripts or issues 10.2.x labels Jul 31, 2026
@bneradt bneradt self-assigned this Jul 31, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@bneradt
bneradt force-pushed the enable-openssl-quic-by-default branch from ad5d3b0 to b2b075b Compare July 31, 2026 21:15
@maskit

maskit commented Jul 31, 2026

Copy link
Copy Markdown
Member

If the OpenSSL version works in a similar way as Quiche version, there is a downside to enabling QUIC automatically. All TLS certs would be loaded twice in total, once by SSLMultiCertConfigLoader and once by QUICMultiCertConfigLoader, even if you don't enable QUIC on records.config. The behavior would be consistent though.

Edit: Actually ENABLE_QUIC may be necessary for Quiche? Regardless, there's that downside.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

OpenSSL 3.5 provides the QUIC implementation ATS needs to accept
HTTP/3 connections from downstream clients. This affects client-to-ATS
traffic, not ATS-to-origin traffic. Requiring an extra opt-in leaves
capable builds without client-facing HTTP/3, but merely compiling QUIC
should not make deployments without QUIC listeners load every TLS
certificate twice.

This makes native OpenSSL QUIC an automatic CMake option. It activates
only with upstream OpenSSL's native server API, remains disabled when
quiche is selected, and preserves explicit ON and OFF overrides.

This also starts the QUIC processor and maintains its certificate
table only when a QUIC listener is configured, avoiding the duplicate
load when HTTP/3 is unused.
@bneradt
bneradt force-pushed the enable-openssl-quic-by-default branch from b2b075b to fb8f4e7 Compare July 31, 2026 22:06
Copilot AI review requested due to automatic review settings July 31, 2026 22:06

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@bneradt

bneradt commented Jul 31, 2026

Copy link
Copy Markdown
Contributor Author

If the OpenSSL version works in a similar way as Quiche version, there is a downside to enabling QUIC automatically. All TLS certs would be loaded twice in total, once by SSLMultiCertConfigLoader and once by QUICMultiCertConfigLoader, even if you don't enable QUIC on records.config. The behavior would be consistent though.

Great point. This is pretty easy to address actually.

Before: quic_NetProcessor.start() was loading a second certificate table for every QUIC-capable build, and coordinated TLS reloads repeated that work even without a :quic listener.

After: this patch changes both paths to check HttpProxyPort::hasQUIC() before doing them.

@bneradt
bneradt merged commit 3ccfb19 into apache:master Jul 31, 2026
15 checks passed
@bneradt
bneradt deleted the enable-openssl-quic-by-default branch July 31, 2026 23:15
@github-project-automation github-project-automation Bot moved this to For v10.2.0 in ATS v10.2.x Jul 31, 2026
cmcfarlen pushed a commit that referenced this pull request Aug 4, 2026
OpenSSL 3.5 provides the QUIC implementation ATS needs to accept
HTTP/3 connections from downstream clients. This affects client-to-ATS
traffic, not ATS-to-origin traffic. Requiring an extra opt-in leaves
capable builds without client-facing HTTP/3, but merely compiling QUIC
should not make deployments without QUIC listeners load every TLS
certificate twice.

This makes native OpenSSL QUIC an automatic CMake option. It activates
only with upstream OpenSSL's native server API, remains disabled when
quiche is selected, and preserves explicit ON and OFF overrides.

This also starts the QUIC processor and maintains its certificate
table only when a QUIC listener is configured, avoiding the duplicate
load when HTTP/3 is unused.

(cherry picked from commit 3ccfb19)
@cmcfarlen cmcfarlen moved this from For v10.2.0 to Picked v10.2.0 in ATS v10.2.x Aug 4, 2026
@cmcfarlen cmcfarlen modified the milestones: 11.0.0, 10.2.0 Aug 4, 2026
@cmcfarlen

Copy link
Copy Markdown
Contributor

Cherry-picked to the 10.2.x branch as 944fb6d for the 10.2.0 release.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

10.2.x Backport Marked for backport for an LTS patch release CMake work related to CMakes scripts or issues HTTP/3

Projects

Status: Picked v10.2.0

Development

Successfully merging this pull request may close these issues.

4 participants