auto-ssl / auto-ssl/lua-resty-auto-ssl
unauthorized access too hook server (hook secret did not match)
- Dominant language
- Lua
- Stars
- 2k
- Forks
- 184
- PR merge metrics
- No merged PRs in 30d
Description
I recently decided to restart `nginx` after some configuration changes, using `sudo systemctl restart nginx`. Afterwards I saw renewal requests failing like so
```
2018/04/09 20:50:45 [error] 12017#12017: *103 [lua] hook.lua:8: server(): auto-ssl: unauthorized access to hook server (hook secret did not match), client: 127.0.0.1, server: , request: "POST /deploy-challenge HTTP/1.1", host: "127.0.0.1:8999"
(...)
+ Requesting challenge for www.somedomain.com...
err: curl: (22) The requested URL returned error: 401 Unauthorized
```
and earlier also
```
+ Requesting challenge for delabrave.com...
err: curl: (7) Failed connect to 127.0.0.1:8999; Connection refused
```
So I am wondering if the previous hook server potentially did not exit when the main `resty` process did? This is an issue for us, since we're quickly in `Error creating new authz :: too many currently pending authorizations` territory when this happens.
Any workarounds?
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the hook.lua:8 server() log entry and the /deploy-challenge hook endpoint, then compare behavior after `sudo systemctl restart nginx` with the earlier connection-refused case. Trace how the hook server relates to the main resty process and verify that renewal requests no longer receive 401 Unauthorized or fail to connect after a restart.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- lua, nginx
- Domain
- devops, infrastructure, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100