How to install nginx-mod in CentOS/RHEL 8 (aarch64)
High-performance web server
Install
sudo dnf -y install https://extras.getpagespeed.com/release-latest.rpm sudo dnf -y install dnf-plugins-core sudo dnf config-manager --enable getpagespeed-extras-testing sudo dnf -y install nginx-mod
Description
nginx [engine x] is an HTTP and reverse proxy server, as well as a mail proxy server. This version adds some patches to improve performance: * HPACK by Cloudflare * Dynamic TLS records Built with OpenSSL 3.5 (ABI-isolated openssl35 package) to support HTTP/3 with post-quantum X25519MLKEM768 key exchange, ensuring you're at the forefront of web technology. Be careful using this in production. This package merely addresses all the crazy folks who want you to compile NGINX to get the above features. The compiled NGINX is evil for many reasons. For more info, see: https://www.getpagespeed.com/server-setup/where-compilation-went-wrong The lesser, as well as faster evil is here. Packaged install is easier to use in production and is also easier to roll back to stable NGINX version in case there's an issue with those patches.
Architecture
Optimized for aarch64 (ARM64) architecture. It can be used on AWS Graviton instances, as well as Raspberry Pi 4 and newer.
Compatibility
This package is compatible with all RHEL-based distributions, including CentOS, AlmaLinux, Oracle Linux, Rocky Linux, etc.
RPMs
| Package | Size | Built | Changes |
|---|---|---|---|
| nginx-mod-1.30.4-61.el8.gps.aarch64 | 1.0 MiB | 2026-08-28 |
Danila Vershinin - nginx-mod-ech: publish rotated keys to DNS. New nginx-ech-publish runs as · the second ExecStart of nginx-ech-rotate.service, so after every successful · rotation the HTTPS record is republished instead of going stale (stale · records silently downgrade every first visit to the retry-config path). · Provider-agnostic: drop-in provider scripts under libexec, Cloudflare · shipped first, configured via /etc/sysconfig/nginx-ech-publish and inert · until a provider is set. The cloudflare provider reuses certbot's · /root/.cloudflare.ini and treats a failed record lookup as a hard error, · never as "no record exists", so it cannot create duplicate HTTPS records. |
| nginx-mod-1.30.4-60.el8.gps.aarch64 | 1.0 MiB | 2026-08-25 |
Danila Vershinin - nginx-mod-ech: roll the generated include back when "nginx -t" fails during · a rotation. Previously a rotation that tripped over an unrelated config · error left the new include committed, so the configuration stayed · unloadable and the next reload by anything else (logrotate, a certificate · renewal) failed too. Now the include is restored and nothing is reloaded. |
| nginx-mod-1.30.4-59.el8.gps.aarch64 | 1.0 MiB | 2026-08-25 |
Danila Vershinin - new subpackage nginx-mod-ech: ECH key generation and rotation. Ships · nginx-ech-keygen (--init / --rotate / --print-dns / --list), a · nginx-ech-rotate systemd timer defaulting to daily, and · /etc/sysconfig/nginx-ech-rotate. Keys live in /etc/nginx/ech as · 0640 root:nginx; the newest is advertised in ECH retry-configs and · ECH_RETAIN-1 older ones stay loaded so clients holding a cached · ECHConfigList still decrypt. The conf.d include is generated by the tool · rather than shipped, so installing the package alone can never point nginx · at key files that do not exist. The timer is not enabled on install. |
| nginx-mod-1.30.4-58.el8.gps.aarch64 | 1.0 MiB | 2026-08-24 |
Danila Vershinin - enable Encrypted Client Hello (ECH, RFC 9849): rebuilt against openssl35 · 3.5.7-5 which carries the ECH backport (DEfO/OpenSSL 4.0 implementation on · the 3.5 LTS line). Adds ssl_ech_file directive plus $ssl_ech_status and · $ssl_ech_outer_server_name variables. ECH engages only when ssl_ech_file · is configured; without it behavior is unchanged. |
| nginx-mod-1.30.4-57.el8.gps.aarch64 | 1.0 MiB | 2026-08-22 |
Danila Vershinin - link against openssl35 (OpenSSL 3.5 LTS, ABI-isolated private prefix) · instead of quictls: native OpenSSL QUIC API, real 0-RTT, post-quantum · X25519MLKEM768 key exchange, CVE stream tracked to April 2030 |