NGINX Unit 1.25.0 Released with TLS Session Cache, Credential Management, IP Identification, Manual App Restart, and Bug Fixes

NGINX Unit 1.25.0 has been released, bringing several new features and important bug fixes.

New features include:

Replace client IP address from a specified HTTP header field.

Add TLS session cache.

Add TLS session tickets (credential management).

Application restart control.

New process and thread lifecycle hooks for Ruby.

Bug fixes address:

Router crash when multiple TLS certificates are configured on listeners.

TLS connection rejection when SNI is absent and multiple certificates are present.

Router crashes during frequent multi‑threaded application reconfiguration.

Compatibility issues with some Python ASGI applications, especially those based on Starlette.

Descriptor and memory leaks when an application process stops or crashes.

Router crashes with IPv6 listener address formats.

Router crashes when a request is passed to an empty "pass" option in routes or upstreams.

Router crashes when a request matches an empty source or destination address pattern array.

TLS session cache and credential management

To save server resources and reduce client connection latency, TLS session cache (server‑side) and TLS session tickets (client‑side) are commonly used. Unit now supports configuring either or both.

{
    "tls": {
        "certificate": "bundle",
        "session": {
            "cache_size": 10000,
            "timeout": 600,
            "tickets": true
        }
    }
}

NGINX Unit is a lightweight, dynamic, open‑source server for various web applications. Built from the ground up, it can run multiple language versions simultaneously and be reconfigured at runtime with zero downtime, enabling real‑time granular management of engineering and operations.