Debian jessie nginx with openssl 1.0.2 to use ALPN rather than NPN

Update 2016/08/08: nginx in jessie-backports (version 1.9.10-1~bpo8+3 was built against openssl >= 1.0.2~. Getting ALPN working now if running jessie just requires the packages out of jessie-backports, no need anymore to pull packages out of stretch.

--

Original answer: Well, here goes my answer, according to the comments: In my opinion, there aren't that many ways to solve this as of today, 2016/05/09. Basically you've to try somehow to get a modern nginx into your system, compiled against >= openssl 1.0.2~.

The only two options I see currently: Either you compile for yourself, which you don't want to do, which is quite understandable, or you pull in modern packages out of Debian stretch into your system. This involves some risks, because you're mixing a stable environment with another one, but in my opinion these risks are quite low, because you're using Debian.

So, let's go and try out this:

• Add the Debian stretch repository to your apt sources. Don't use /etc/apt/sources.list for this, but instead use a dedicated file inside /etc/apt/sources.list.d/ to keep it clean, personally I'm using stretch.list.

  Put these lines inside there:

  deb http://httpredir.debian.org/debian/ stretch main contrib non-free
  deb-src http://httpredir.debian.org/debian/ stretch main contrib non-free
  
  deb http://security.debian.org/ stretch/updates main contrib non-free
  deb-src http://security.debian.org/ stretch/updates main contrib non-free
  
  # stretch-updates, previously known as 'volatile'
  deb http://httpredir.debian.org/debian/ stretch-updates main contrib non-free
  deb-src http://httpredir.debian.org/debian/ stretch-updates main contrib non-free
  

• Set up apt pinning to make sure you only pull in packages out of Debian stretch which you're specifying. The file to use for this is /etc/apt/preferences, inside there, put:

  Package: *
  Pin: release n=jessie
  Pin-Priority: 900
  
  Package: * 
  Pin: release a=jessie-backports
  Pin-Priority: 500
  
  Package: *
  Pin: release n=stretch
  Pin-Priority: 100
  

  (You might have to alter the suites and priorities to fit your environment.)

• Run apt-get update (via sudo / as root) to update the package cache.

• Install nginx from Debian stretch: apt-get install -t stretch nginx (do this via sudo / as root). Profit!

• As I described in my comment(s), to even lower the risks involved, you could use something like a chroot or a container-solution like LXC. In case you want to go the chroot way, you have to set up a network interface inside there: To do this, have a look at this blogpost for example, which gives an introduction to network namespaces.

• Hope this helps; in case you've got more question, feel free to contact me. I would appreciate feedback and I'm interested in how it goes.

Another method is to install OpenSSL 1.0.2 from jessie-backports and use Ubuntu 16.04 LTS builds from nginx's own repository. That way you're at least using an OpenSSL package built for Jessie.

Add to /etc/apt/sources.list:

# jessie-backports, from stretch-level but with no dependencies
deb http://httpredir.debian.org/debian/ jessie-backports main contrib non-free
deb-src http://httpredir.debian.org/debian/ jessie-backports main contrib non-free

# Nginx repository - use Ubuntu 16.04 LTS Xenial to get packages compiled with OpenSSL 1.0.2
deb http://nginx.org/packages/mainline/ubuntu/ xenial nginx
deb-src http://nginx.org/packages/mainline/ubuntu/ xenial nginx

Then run:

apt-get update
apt-get install -t jessie-backports openssl
apt-get install nginx

This obviously puts you into an officially unsupported configuration, but perhaps that's better than not having a package at all - and it worked for me. Plus, using nginx's repo means you get fresh updates.

Another method is to use jessie-backports and then rebuild easily nginx

add to /etc/apt/sources.list backports

deb http://ftp.debian.org/debian jessie-backports main

and then run as root

apt-get update
apt-get install -t jessie-backports openssl

and then rebuild nginx. Follow instructions on https://wiki.debian.org/BuildingAPackage

For me the easiest way to fix this was to use a different Nginx Docker image, see the official Nginx build on Docker Hub. The default Docker Nginx build uses Debian Jessie so that won't fix your problem, but they also offer an alternative build based on Alpine Linux. Its latest builds do use OpenSSL 1.0.2!

This solution thus assumes that you installed Docker and are fine with running Nginx on Alpine Linux instead of Debian Jessie.

To start your Nginx container:

sudo docker run --name nginx-container -p 80:80 -p 443:443 -v /path/to/your/nginx/directory/:/etc/nginx/ /path/to/your/files/to/serve/:/usr/share/nginx/html/ -d nginx:1.11-alpine

Short explanation to get you started with Docker:

• docker run: downloads the Docker image (in this case nginx:1.11-alpine) if you don't have it yet and starts a Docker container based on this image
• --name nginx-container: gives the Docker container a name (you can view all running Docker containers using sudo docker ps or use sudo docker ps -a to also view stopped containers)
• -p 80:80 -p 443:443: binds ports 80 and 443 on your host machine to respectively ports 80 and 443 in the Docker container
• -v /path/to/your/nginx/directory/:/etc/nginx/: mounts the directory on your host system which contains your Nginx configuration to the /etc/nginx/ directory in the Docker container
• /path/to/your/files/to/serve/:/usr/share/nginx/html/: mounts a directory on your host system which contains files you want Nginx to serve
• -d: starts the container in the background (you can stop the container using docker stop nginx-container)
• nginx:1.11-alpine: use this image to start your container from (the official Nginx Docker images are listed here)

Also useful:

• use sudo docker exec nginx-container <command> to run a command in the container, for example sudo docker exec nginx-container nginx -s reload to reload Nginx after you've changed the configuration files on the host system
• Or use sudo docker exec -it nginx-container bash to enter a bash shell in the container so you can work there directly (not recommended, but sometimes useful)

An alternative way is to use BoringSSL instead, which does not hurt OpenSSL surroundings. Here is details to refer to, https://www.admon.org/hardwares/enable-http2-support-for-nginx-on-debian-jessie

In my situation I've used the Dotdeb apt repository. The instructions of this website gives an option to add a repository which allows you to install Nginx with “full” HTTP2 support. The current version is 1.14 which is one minor behind the last release, so you won't be too far behind (current backport is 1.10).