Pre shared keys (TLS-PSK) NGINX configuration

Question

I have a very constrained device running on battery power that doesn't have the horsepower to do key exchange, so instead, we'd like to use PSK (pre-shared keys) to secure the channel. I can't seem to find any information on how to configure this with NGINX.

I see that ssl_ciphers has PSK (which I've enabled) but where/how do I specify the shared keys between NGINX and the client? Is this supported?

Answer 1

As of now, nginx does not support PSK ciphers. There is an attempt to add support though, some preliminary patches can be found here:

http://mailman.nginx.org/pipermail/nginx-devel/2017-September/010460.html

If you are interested in adding PSK support, please consider testing the patches and providing some feedback on them.

Answer 2

You might use a stunnel for this. It supports TLS-PSK and is easy to set up!