SYSTEM Cited by 1 source
BoringSSL¶
What¶
BoringSSL (github.com/google/boringssl) is Google's fork of OpenSSL — a TLS/crypto library designed for Google's specific needs. "Lives up to its name": minimal CVEs, minimal changes, high stability over long periods. Used by Chromium, Android, and multiple infrastructure projects including Cloudflare's Pingora Origin service.
Role at Cloudflare¶
Pingora Origin uses BoringSSL (via Cloudflare's cloudflare/boring Rust bindings) for all Cloudflare-to-origin TLS connections. Cloudflare maintained an internal fork for four years rather than tracking upstream — patching in additional functionality as needed. This worked due to BoringSSL's stability, but the approach broke down when post-quantum authentication support landed upstream in April 2026 and motivated a long-overdue update.
The four-year update incident (June 2026)¶
The aggregated four-year delta included a KeyUsage enforcement commit (aligning with RFC 5280 §4.2.1.3) that rejected certificates with technically invalid KeyUsage extensions. Despite weeks of testing and slow rollout, a small number of customers' RSA certificates were deemed invalid — causing an incident on June 10, 2026. Cloudflare rolled back, then patched to retain support for non-compliant RSA certificates.
Canonical wiki instance of the "the Internet is not RFC compliant" operational reality — spec-correct enforcement must be deployed progressively, not atomically across a global fleet.
(Source: sources/2026-07-29-cloudflare-post-quantum-authentication-to-origins)
Seen in¶
- sources/2026-07-29-cloudflare-post-quantum-authentication-to-origins — four-year update gap, PQ auth motivation, KeyUsage incident, patch.
Related¶
- systems/pingora-origin — the Rust proxy service that embeds BoringSSL
- systems/cloudflare-circl — Go-side crypto library (complementary; control plane)
- concepts/post-quantum-authentication — the motivation for the overdue update