# SSL Randomness Source

**URL:** <https://www.ruby-forum.com/t/ssl-randomness-source/191557>\
**Category:** NGINX\
**Created:** [July 14, 2010, 2:12pm UTC](https://www.ruby-forum.com/t/ssl-randomness-source/191557 "2010-07-14T14:12:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dave\_Barton](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ecc23a/32.png) [@Dave\_Barton](https://www.ruby-forum.com/u/Dave_Barton)\
**Post date:** [July 14, 2010, 2:12pm UTC](https://www.ruby-forum.com/t/ssl-randomness-source/191557/1 "2010-07-14T14:12:45Z")

</div>

We currently run nginx on the majority of our internet-facing webservers  
and we process a lot of SSL traffic. That’s a lot of SSL handshakes and  
a lot of entropy required. To help with this, we’ve bought some USB  
pseudo-random entropy generating keys. These basically give the server a  
fast source of entropy, which can be accessed via /dev/random.

In Apache, the SSL configuration includes a directive ‘SSLRandomSeed’  
which allows you to define a source for randomness, with the default  
being ‘builtin’ which uses some Apache internals as a PRNG. It includes  
options to use a filesystem location (/dev/random for example) or an egd  
(entropy daemon) source.

Can anyone tell me where nginx SSL gets its entropy from by default and  
whether it can be changed?

Cheers

Dave

---

<div class="post-metadata">

**Author:** ![Dave\_Barton](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ecc23a/32.png) [@Dave\_Barton](https://www.ruby-forum.com/u/Dave_Barton)\
**Post date:** [July 14, 2010, 2:45pm UTC](https://www.ruby-forum.com/t/ssl-randomness-source/191557/2 "2010-07-14T14:45:33Z")

</div>

On Wed, Jul 14, 2010 at 01:11:37PM +0100, Dave Barton wrote:

> (entropy daemon) source.
> 
> Can anyone tell me where nginx SSL gets its entropy from by default and  
> whether it can be changed?

nginx uses OpenSSL default entropy source. On Unix systems OpenSSL tries  
to use /dev/urandom, /dev/random, /dev/srandom one after another.  
On FreeBSD /dev/urandom is symlink to /dev/random.

–  
Igor S.

> **[Igor Sysoev](http://sysoev.ru/en/)**

---

<div class="post-metadata">

**Author:** ![Dave\_Barton](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ecc23a/32.png) [@Dave\_Barton](https://www.ruby-forum.com/u/Dave_Barton)\
**Post date:** [July 14, 2010, 3:01pm UTC](https://www.ruby-forum.com/t/ssl-randomness-source/191557/3 "2010-07-14T15:01:22Z")

</div>

Thanks Igor. That’s just what I needed.

Cheers

Dave