[RFC] Implement ACME Automatic SSL for Apache APISIX Gateway
- Dominant language
- Lua
- Stars
- 17.1k
- Forks
- 2.9k
- Avg merge
- 3d 16h
- Merged PRs (30d)
- 63
Description
### Description
# Introduction
This RFC proposes the implementation of ACME (Automatic Certificate Management Environment) to automate the process of obtaining and renewing SSL/TLS certificates for the Apache APISIX Gateway. This will enhance security by ensuring that all communications are encrypted and up-to-date with minimal manual intervention.
# Motivation
Currently, managing SSL certificates for the Apache APISIX Gateway involves manual processes that are prone to errors and can lead to downtime if certificates expire. By integrating ACME, we can automate this process, reducing the risk of expired certificates and improving the overall security posture.
# Proposal
Introducing new way to automatically manage SSL certificate, this proposal intend to not make any modification to current process to manage certificate. Let user decide how they want to manage certificate via `yaml` config
This proposal will use this library to automatically handle certificate management. This library support multiple storage backend such as etcd or local file.
- https://github.com/fffonion/lua-resty-acme
Example implementation
config
```yaml
apisix:
ssl:
automatic: true
acme:
some-comfig:
```
ngx template
```
{% if acme_enabled then %}
ssl_certificate_by_lua_block {
require("resty.acme.autossl").ssl_certificate()
}
location /.well-known {
content_by_lua_block {
require("resty.acme.autossl").serve_http_challenge()
}
}
{% else %}
ssl_client_hello_by_lua_block {
apisix.http_ssl_client_hello_phase()
}
ssl_certificate_by_lua_block {
apisix.http_ssl_phase()
}
{% end %}
```
## Pros
- No need to create bash script to generate SSL certificate and update via admin api
- Fully automatic including automatic renewal
## Cons
- Only able to use one method to manage SSL certificate, either it manual or automatic
Contributor guide
Research direction
Start by reviewing the proposed YAML configuration and the ngx template, then inspect the referenced lua-resty-acme entry points: resty.acme.autossl().ssl_certificate() and serve_http_challenge(). The issue names no repository files or tests; done would require an agreed design that supports automatic issuance and renewal while preserving the existing manual certificate-management path.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- lua, nginx
- Domain
- api, networking, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100