apache / apache/apisix

[RFC] Implement ACME Automatic SSL for Apache APISIX Gateway

Open
#11,845 6 comments 4 reactions 0 assignees View on GitHub
enhancement
Dominant language
Lua
Stars
17.1k
Forks
2.9k
Avg merge
3d 16h
Merged PRs (30d)
63

Description

### Description

# Introduction

This RFC proposes the implementation of ACME (Automatic Certificate Management Environment) to automate the process of obtaining and renewing SSL/TLS certificates for the Apache APISIX Gateway. This will enhance security by ensuring that all communications are encrypted and up-to-date with minimal manual intervention.

# Motivation

Currently, managing SSL certificates for the Apache APISIX Gateway involves manual processes that are prone to errors and can lead to downtime if certificates expire. By integrating ACME, we can automate this process, reducing the risk of expired certificates and improving the overall security posture.

# Proposal

Introducing new way to automatically manage SSL certificate, this proposal intend to not make any modification to current process to manage certificate. Let user decide how they want to manage certificate via `yaml` config

This proposal will use this library to automatically handle certificate management. This library support multiple storage backend such as etcd or local file.

- https://github.com/fffonion/lua-resty-acme

Example implementation

config

```yaml
apisix:
ssl:
automatic: true
acme:
some-comfig:
```

ngx template

```
{% if acme_enabled then %}
ssl_certificate_by_lua_block {
require("resty.acme.autossl").ssl_certificate()
}
location /.well-known {
content_by_lua_block {
require("resty.acme.autossl").serve_http_challenge()
}
}
{% else %}
ssl_client_hello_by_lua_block {
apisix.http_ssl_client_hello_phase()
}

ssl_certificate_by_lua_block {
apisix.http_ssl_phase()
}
{% end %}
```

## Pros
- No need to create bash script to generate SSL certificate and update via admin api
- Fully automatic including automatic renewal

## Cons
- Only able to use one method to manage SSL certificate, either it manual or automatic

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the proposed YAML configuration and the ngx template, then inspect the referenced lua-resty-acme entry points: resty.acme.autossl().ssl_certificate() and serve_http_challenge(). The issue names no repository files or tests; done would require an agreed design that supports automatic issuance and renewal while preserving the existing manual certificate-management path.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua, nginx
Domain
api, networking, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.