Changed
Automatic TLS
- ACME fallback improvements: Ferron now tries each configured fallback provider when the primary provider fails when provisioning a certificate (not just on account creation).
- ACME certificate installation: Certificates are now reused from cache early before ACME provisioning cycles to mitigate TLS certificate errors after reloading the configuration.
OCSP stapling
- OCSP status logging and metrics: added
ferron.ocsp.cert.statusattribute to log records and metric labels, allowing the certificate's OCSP status (good,revoked,unknown) to be logged and monitored.
Observability
- No metric exemplars linking to sampled-out traces: metric exemplars are no longer linked to traces that are sampled out (and thus not exported) to avoid misleading observability tools and reduce debugging friction.
Reverse proxy
- Connection pool racing improvements: when the connection pool is racing and multiple connections are being established simultaneously, the connection pool now selects the connection that is ready first, avoiding unnecessary delays and improving overall performance.
Fixed
HTTP server core
- Backlog size fix: the default backlog size is now 4096 on Linux, and -1 on Windows, *BSD, and macOS. It was -1 on all platforms before this change (which would be equivalent to 0 on Linux).
- Response body streaming fix: response body streaming is now fixed to avoid buffering instead of streaming, improving performance and memory usage. This also allows Ferron to be used as a reverse proxy for web applications that use SSE (Server-Sent Events). (GitHub issue)
Automatic TLS
- Automatic renewal info fix: fixed an issue where automatic renewal information was not applied correctly, leading to confusion about certificate expiration.