auto-ssl / auto-ssl/lua-resty-auto-ssl
Outdated dehydrated & Step-CA interoperability
- Dominant language
- Lua
- Stars
- 2k
- Forks
- 184
- PR merge metrics
- No merged PRs in 30d
Description
It seems like `lua-resty-auto-ssl` uses an outdated version of dehydrated. This causes issues with proper decoding of JSON responses which in turn fails ACME request:
```
web_1 | 2021/03/17 06:29:52 [error] 19#19: *3 [lua] lets_encrypt.lua:40: issue_cert(): auto-ssl: dehydrated failed: env HOOK_SECRET=.... HOOK_SERVER_PORT=8999 /usr/local/openresty/luajit/bin/resty-auto-ssl/dehydrated --cron --accept-terms --no-lock --domain example.com --challenge http-01 --config /etc/resty-auto-ssl/letsencrypt/config --hook /usr/local/openresty/luajit/bin/resty-auto-ssl/letsencrypt_hooks status: 256 out: # INFO: Using main config file /etc/resty-auto-ssl/letsencrypt/config
web_1 | startup_hook
web_1 | Processing example.com
web_1 | + Signing domains...
web_1 | + Generating private key...
web_1 | + Generating signing request...
web_1 | + Requesting new certificate order from CA...
web_1 | err: + ERROR: An error occurred while sending post-request to https://ca:9000/acme/acme/new-order (Status 400)
web_1 |
web_1 | Details:
web_1 | HTTP/2 400
web_1 | cache-control: no-store
web_1 | content-type: application/problem+json
web_1 | link: ;rel="index"
web_1 | replay-nonce: ...
web_1 | content-length: 186
web_1 | date: Wed, 17 Mar 2021 06:29:52 GMT
web_1 |
web_1 | {"type":"urn:ietf:params:acme:error:malformed","detail":"kid does not have required prefix; expected https://ca:9000/acme/acme/account/, but got https://ca:9000/acme/acme/new-account/"}
web_1 |
web_1 |
web_1 | , context: ssl_certificate_by_lua*, client: 172.20.0.1, server: 0.0.0.0:443
web_1 | 2021/03/17 06:29:52 [error] 19#19: *3 [lua] ssl_certificate.lua:97: issue_cert(): auto-ssl: issuing new certificate failed: dehydrated failure, context: ssl_certificate_by_lua*, client: 172.20.0.1, server: 0.0.0.0:443
web_1 | 2021/03/17 06:29:52 [error] 19#19: *3 [lua] ssl_certificate.lua:291: auto-ssl: could not get certificate for example.com - using fallback - failed to get or issue certificate, context: ssl_certificate_by_lua*, client: 172.20.0.1, server: 0.0.0.0:443
```
I traced this to https://github.com/dehydrated-io/dehydrated/issues/689 which pointed me to https://github.com/dehydrated-io/dehydrated/issues/731. Indeed, using new version of `dehydrated` by replacing `/usr/local/openresty/luajit/bin/resty-auto-ssl/dehydrated` in the container (tested with [#0094147](https://github.com/dehydrated-io/dehydrated/blob/00941472b2680a3f681a0f8382ac4f631b64d9ee/dehydrated)) fixes the problem.
I believe dehydrated needs to be updated. WDYT?
Contributor guide
No contributing guide indexed for this repository
Research direction
Inspect the bundled dehydrated executable at /usr/local/openresty/luajit/bin/resty-auto-ssl/dehydrated and the ACME flow described in the issue. Compare it with the tested dehydrated revision, then verify that the Step-CA new-order request succeeds without the malformed kid error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- lua, nginx
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100