auto-ssl / auto-ssl/lua-resty-auto-ssl

Auto renewal isn't working if the server's started in a directory which can't be accessed by nginx user

Open
#137 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Lua
Stars
2k
Forks
184
PR merge metrics
No merged PRs in 30d

Description

How to reproduce it:
1) Go to a directory which can't be accessed by nginx user, e.g. `/home/ec2-user`
2) Start nginx server `/usr/local/openresty/nginx/sbin/nginx -c /usr/local/openresty/nginx/conf/nginx.conf`

Expected outcome: auto renewal will fail with the following error message `[error] 2223#0: *725 [lua] renewal.lua:142: auto-ssl: failed to fetch all certificate domains: Executing command failed: find /etc/resty-auto-ssl/storage/file -name '*%3Alatest'`.
The output of the command is truncated, so it's not clear what caused `find` to fail. My guess is that it's `find: Failed to restore initial working directory: Permission denied` error. I tried to verify it by starting the server from `/tmp` directory and it did work.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in renewal.lua around line 142 and inspect how the certificate-domain lookup runs the find command and reports failures. Reproduce from /home/ec2-user and /tmp, then verify that auto renewal succeeds or exposes the underlying working-directory error instead of truncating it.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua, nginx
Domain
backend, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.