auto-ssl / auto-ssl/lua-resty-auto-ssl

unauthorized access too hook server (hook secret did not match)

Open
#121 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Lua
Stars
2k
Forks
184
PR merge metrics
No merged PRs in 30d

Description

I recently decided to restart `nginx` after some configuration changes, using `sudo systemctl restart nginx`. Afterwards I saw renewal requests failing like so

```
2018/04/09 20:50:45 [error] 12017#12017: *103 [lua] hook.lua:8: server(): auto-ssl: unauthorized access to hook server (hook secret did not match), client: 127.0.0.1, server: , request: "POST /deploy-challenge HTTP/1.1", host: "127.0.0.1:8999"

(...)
+ Requesting challenge for www.somedomain.com...
err: curl: (22) The requested URL returned error: 401 Unauthorized
```

and earlier also

```
+ Requesting challenge for delabrave.com...
err: curl: (7) Failed connect to 127.0.0.1:8999; Connection refused
```

So I am wondering if the previous hook server potentially did not exit when the main `resty` process did? This is an issue for us, since we're quickly in `Error creating new authz :: too many currently pending authorizations` territory when this happens.

Any workarounds?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the hook.lua:8 server() log entry and the /deploy-challenge hook endpoint, then compare behavior after `sudo systemctl restart nginx` with the earlier connection-refused case. Trace how the hook server relates to the main resty process and verify that renewal requests no longer receive 401 Unauthorized or fail to connect after a restart.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua, nginx
Domain
devops, infrastructure, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.