auto-ssl / auto-ssl/lua-resty-auto-ssl

Renew certificate when expire

Open
#158 11 comments 2 reactions 0 assignees View on GitHub
Dominant language
Lua
Stars
2k
Forks
184
PR merge metrics
No merged PRs in 30d

Description

Hi,
I have a problem when certificate is expired saved in Redis.

We have multi-tenant app and user Redis for storage service. The problem I met today is that Nginx serve expired certificates.

We use AWS and has autoscaling group. I delete all certificates from Redis and Nginx continue to serve expired certificates and didn't create new certs.

When create new instance in autoscaling group NGINX start create new certificates. May be the problem is in local cache.

lua_shared_dict auto_ssl 5m;
lua_shared_dict auto_ssl_settings 64k;
............
auto_ssl = (require "resty.auto-ssl").new({
storage_adapter = "resty.auto-ssl.storage_adapters.redis",
redis = {
host = os.getenv("DREAMSHOP__REDIS__HOST"),
port = 6379,
prefix = os.getenv("DREAMSHOP__REDIS__CERTS__KEYS__PREFIX")
},
allow_domain = function(domain, allow_domain_auto_ssl)

if ngx.re.match(domain, "^(.*mydreamshop.io).*$", "ijo") then
return false
end

local redis = allow_domain_auto_ssl.storage.adapter:get_connection()
local prefix = allow_domain_auto_ssl:get("sites_prefix")

if redis then
if 1 == redis:exists(prefix.."["..domain.."][1]") then
return true
else
return false
end
else
return true
end
end
})

auto_ssl:set("sites_prefix", os.getenv("DREAMSHOP__REDIS__DOMAINS__KEYS__PREFIX"))
auto_ssl:init()

Contributor guide

No contributing guide indexed for this repository

Research direction

The report provides an OpenResty/nginx configuration using resty.auto-ssl, the Redis storage adapter, and lua_shared_dict auto_ssl; no source file or test is named. Start by reproducing the expired-certificate case after deleting Redis data and trace whether local shared state prevents renewal. Done means an expired certificate is replaced without requiring a new autoscaling instance.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua, nginx, redis
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.