Skip to content

Parallell ssl cert load#12998

Open
ezelkow1 wants to merge 4 commits intoapache:masterfrom
ezelkow1:ssl-master-11
Open

Parallell ssl cert load#12998
ezelkow1 wants to merge 4 commits intoapache:masterfrom
ezelkow1:ssl-master-11

Conversation

@ezelkow1
Copy link
Member

Adds a new config proxy.config.ssl.server.multicert.concurrency

Defaults to 1 for single core usage, however even with that on first load it will use all cores for cert loading. After that it will use the specified value 0(auto)/1(default)/N(number of threads) when doing reloads of certs

@ezelkow1 ezelkow1 added this to the 11.0.0 milestone Mar 18, 2026
@ezelkow1 ezelkow1 self-assigned this Mar 18, 2026
@ezelkow1 ezelkow1 added the SSL label Mar 18, 2026
@ezelkow1 ezelkow1 requested review from bryancall and zwoop March 18, 2026 23:08
@zwoop zwoop requested a review from Copilot March 19, 2026 20:16
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds support for parallel loading of ssl_multicert.yaml certificates, controlled by a new records.config setting, to speed up certificate (re)configuration in ATS’s TLS / QUIC certificate loaders.

Changes:

  • Introduces proxy.config.ssl.server.multicert.concurrency (records + docs) and threads the value through SSLConfigParams.
  • Updates SSLMultiCertConfigLoader to optionally load multicert items in parallel using std::thread, with locking for shared SSLCertLookup mutations.
  • Extends the gold test to cover the new parallel-loading behavior.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 6 comments.

Show a summary per file
File Description
tests/gold_tests/tls/ssl_multicert_loader.test.py Adds a new gold test section intended to validate parallel loading behavior.
src/records/RecordsConfig.cc Registers the new proxy.config.ssl.server.multicert.concurrency record.
src/iocore/net/SSLUtils.cc Implements the parallel multicert loading logic and adds locking around shared lookup mutation.
src/iocore/net/SSLConfig.cc Reads the new concurrency record into SSLConfigParams and passes “first load” state into the loader.
src/iocore/net/QUICMultiCertConfigLoader.cc Updates QUIC cert reload path to pass “first load” state into the loader.
src/iocore/net/P_SSLConfig.h Adds configLoadConcurrency to SSLConfigParams.
include/iocore/net/SSLMultiCertConfigLoader.h Updates loader API to accept firstLoad and adds _load_items() + mutex.
doc/admin-guide/files/records.yaml.en.rst Documents the new configuration record and its behavior.

zwoop
zwoop previously approved these changes Mar 19, 2026
Copy link
Contributor

@zwoop zwoop left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This generally looks good now, couple of nitpicks, at your discretion to address or not.

Change to just do a clamp as well if firstLoad
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants