nginx 1.29

NGINX 1.29 was a mainline cycle. Its notable addition was native ACME support through the ngx_http_acme_module, allowing NGINX to obtain and manage certificates from ACME certificate authorities rather than requiring a separate certificate-management workflow for every deployment. The cycle also added integration for using ACME-obtained certificates in TLS configuration and accumulated the usual mainline bug fixes and compatibility work over its point releases. Teams upgrading from an earlier line should treat ACME configuration as a new optional capability, not as a requirement to replace an existing certificate automation tool.

This cycle has reached end of life, so it no longer receives upstream fixes. Remaining on it means accepting that subsequently corrected defects, security issues, protocol interoperability problems, and build or platform compatibility fixes will not be backported to 1.29. The risk is higher for internet-facing reverse proxies, TLS termination points, and deployments that rely on ACME automation, where a defect can affect certificate renewal or availability. Third-party modules and current operating-system toolchains may also increasingly target supported NGINX branches rather than 1.29.

Select a currently supported NGINX Open Source branch and review its intervening changelogs and upgrade notes before moving production traffic. Inventory the installed NGINX version, build options, dynamic and third-party modules, OpenSSL linkage, configuration includes, and certificate-management process. Rebuild or replace modules that are not compatible with the target branch, then test the full configuration in a non-production environment. If using the 1.29 ACME module, verify issuer settings, challenge handling, certificate storage, renewal behavior, and fallback certificates; if not using it, confirm that the existing external automation still reloads NGINX safely. Deploy first to a canary or low-risk pool, monitor startup errors, TLS handshakes, upstream behavior, and certificate renewal, and retain a tested rollback path.