Hitch TLS is a TLS terminator that can be used with Varnish Plus to handle client-side TLS connections. It provides a fast and scalable TLS termination solution. Varnish Plus also supports TLS to the backend by adding ".ssl = 1" to the backend definition. Both solutions provide high performance TLS handling. Future improvements to Hitch TLS and backend TLS in Varnish Plus are ongoing to improve configuration flexibility and add features like OCSP stapling.

1. SSL/TLS with Varnish Plus

2. Agenda
● SSL/TLS
● Client-side TLS with Hitch TLS
● TLS to the backend with Varnish Cache Plus

3. TLS basics
● TLS - standardised encryption protocol
○ Confidentiality
○ Authentication
○ Integrity
● Lives on top of TCP, below HTTP
● TLS is originally based on SSL
● All SSL versions are broken
● TLS 1.2 is the one you should use

4. Hitch TLS
● A small and fast TLS terminator
● Developed by Varnish Software
● Hitch TLS is bundled with Varnish Plus
○ Official packages and support
● Based on the “stud” project by Bump
Technologies
● Freely available. BSD license
● https://hitch-tls.org/

5. ● Event-driven using libev
● Non-blocking IO
● One main management process
● N child processes, doing the actual heavy
lifting
Architecture

6. Setup and configuration
● Official packages available with Varnish Plus
● Community packages for Debian and
RHEL/Fedora and FreeBSD
● Latest release 1.2.0-beta1
● Configuration in
/etc/hitch/hitch.conf

8. PROXY protocol
● Transmit client endpoints in a tiny preamble
● Specified by Willy Tarreau of HAProxy
● Example PROXYv1 header:
PROXY TCP4 192.168.0.1 192.168.0.11 56324 443rn
● Supported in Varnish Cache Plus 4.0- and in
Varnish 4.1.
○ VCL: client.ip, server.ip,
remote.ip, local.ip

9. Run-time reloads
● New in Hitch
● Seamlessly load new certificates and listen
endpoints without interrupting service
● Hitch will re-read its config on SIGHUP
# service hitch reload

10. Performance
● In short: very good
● Scales with any (reasonable) number of CPU
cores
● Up to 3000 new connections per second per
core (“SSL accelerator” cards not needed)
● Fills 10Gbit ethernet without much effort
● Tested with 500K certificates

11. Future improvements
● Improved configuration flexibility (in beta now)
● OCSP stapling
● Shared session cache improvements
● ALPN/NPN for HTTP/2

12. TLS to the backend
● Built into Varnish Cache Plus from 4.0.3r3
(June 2015)
● Add “.ssl = 1” to backend definition to
use TLS
● SNI on by default.
● Other options: disable SNI and certificate
checking.

14. Backend performance test
● nginx backend with TLS on 10Gb LAN
● wrk toward local Varnish
● Focus on latency, not throughput

18. Backend TLS performance
● On a LAN: costly, but still very fast
● On a WAN: smaller differences, but the extra
roundtrips will slow down the first request
● Once established the TLS connections are
fast

19. Backend TLS future
● Feature complete
● Ongoing support in Varnish Cache Plus

20. Summary
● You can do TLS/SSL both to the client and to
the backend with Varnish Plus
● All components are supported in Plus.
● High performance is ensured.

21. Questions?