Add support for TLS Certificate Compression (RFC 8879) - #13088
Merged
Conversation
Member
|
[approve ci] |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds TLS Certificate Compression (RFC 8879) support to ATS (behind new configuration knobs and feature detection), with counters/metrics and an autest that validates compression/decompression between two ATS instances.
Changes:
- Introduces config records to enable certificate compression algorithms for server/client TLS contexts.
- Wires certificate compression registration into server (
SSLMultiCertConfigLoader) and client (SSLInitClientContext) SSL_CTX initialization. - Adds per-algorithm compress/decompress success/failure metrics plus docs and a gold test.
Reviewed changes
Copilot reviewed 25 out of 25 changed files in this pull request and generated 10 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/gold_tests/tls/tls_cert_comp.test.py | New gold test that runs edge↔mid TLS with cert compression enabled and checks metrics. |
| tests/gold_tests/tls/replay/tls_cert_compression.replay.yaml | Replay definition used by verifier server/client in the new test. |
| src/traffic_layout/info.cc | Adds TS_HAS_CERT_COMPRESSION feature flag output based on TLS library capabilities. |
| src/records/RecordsConfig.cc | Registers new proxy.config.ssl.{server,client}.cert_compression.algorithms records. |
| src/iocore/net/TLSCertCompression.h | Declares certificate compression registration API. |
| src/iocore/net/TLSCertCompression.cc | Implements registration logic for supported TLS library APIs. |
| src/iocore/net/TLSCertCompression_zlib.h/.cc | Adds zlib compression/decompression callbacks + metrics increments. |
| src/iocore/net/TLSCertCompression_brotli.h/.cc | Adds brotli compression/decompression callbacks + metrics increments. |
| src/iocore/net/TLSCertCompression_zstd.h/.cc | Adds zstd compression/decompression callbacks + metrics increments. |
| src/iocore/net/SSLUtils.cc | Enables cert compression for server contexts during multicert load. |
| src/iocore/net/SSLClientUtils.cc | Enables cert compression preference for client SSL_CTX initialization. |
| src/iocore/net/SSLStats.h / src/iocore/net/SSLStats.cc | Adds/initializes new cert compression/decompression counters. |
| src/iocore/net/SSLConfig.cc | Loads new config values into SSLConfigParams and frees them on cleanup. |
| src/iocore/net/P_SSLConfig.h | Adds fields to hold configured algorithm lists. |
| include/iocore/net/SSLMultiCertConfigLoader.h | Declares new _enable_cert_compression() hook. |
| src/iocore/net/CMakeLists.txt | Adds new sources and links brotli/zstd libs when available. |
| cmake/Findbrotli.cmake | Adds brotlidec discovery + imported target for decoder library. |
| include/tscore/ink_config.h.cmake.in | Adds generated feature macros for cert compression APIs. |
| CMakeLists.txt | Detects cert compression symbols in the TLS library headers. |
| doc/admin-guide/monitoring/statistics/core/ssl.en.rst | Documents new cert compression/decompression metrics. |
| doc/admin-guide/files/records.yaml.en.rst | Documents the new configuration records and supported values. |
bneradt
requested changes
Apr 21, 2026
bneradt
left a comment
bneradt
left a comment
Contributor
There was a problem hiding this comment.
Looks like a helpful feature.
bneradt
requested changes
Apr 22, 2026
bneradt
approved these changes
Apr 22, 2026
cmcfarlen
added a commit
to cmcfarlen/trafficserver
that referenced
this pull request
Jun 2, 2026
PR apache#13088 (TLS Certificate Compression) was authored against post-apache#12755 master where ssl_multicert.yaml replaced ssl_multicert.config. 10.2.x intentionally omits that Incompatible migration, so ts.Disk has no ssl_multicert_yaml attribute. Translate the two YAML blocks back to the single-line legacy ssl_multicert.config syntax used by every other tls gold test on 10.2.x. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
cmcfarlen
pushed a commit
that referenced
this pull request
Jun 9, 2026
New settings: proxy.config.ssl.server.cert_compression.algorithms proxy.config.ssl.client.cert_compression.algorithms proxy.config.ssl.server.cert_compression.cache is going to be added on next PR. New metrics: proxy.process.ssl.cert_compress.<alg> proxy.process.ssl.cert_compress.<alg>_failure proxy.process.ssl.cert_decompress.<alg> proxy.process.ssl.cert_decompress.<alg>_failure (cherry picked from commit 02af451)
cmcfarlen
pushed a commit
to cmcfarlen/trafficserver
that referenced
this pull request
Jul 29, 2026
New settings: proxy.config.ssl.server.cert_compression.algorithms proxy.config.ssl.client.cert_compression.algorithms proxy.config.ssl.server.cert_compression.cache is going to be added on next PR. New metrics: proxy.process.ssl.cert_compress.<alg> proxy.process.ssl.cert_compress.<alg>_failure proxy.process.ssl.cert_decompress.<alg> proxy.process.ssl.cert_decompress.<alg>_failure
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Compression/decompression won't be used by default. Setting at least one algorithm enables it.
New settings:
proxy.config.ssl.server.cert_compression.algorithmsproxy.config.ssl.client.cert_compression.algorithmsproxy.config.ssl.server.cert_compression.cacheis going to be added on next PR.New metrics:
proxy.process.ssl.cert_compress.<alg>proxy.process.ssl.cert_compress.<alg>_failureproxy.process.ssl.cert_decompress.<alg>proxy.process.ssl.cert_decompress.<alg>_failureAutest:
The test launches two ATS processes, and use compression between them, because there isn't a good client that supports the compression.