You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This directive runs user Lua code when Nginx is about to post-process the SSL server certificate request message from upstream. It is particularly useful for setting the SSL certificate chain and the corresponding private key for the upstream SSL (https) connections. It is also useful to load such handshake configurations nonblockingly from the remote (for example, with the [cosocket](#ngxsockettcp) API).
3251
+
3252
+
The [ngx.ssl.proxysslcert](https://github.com/openresty/lua-resty-core/blob/master/lib/ngx/ssl/proxysslcert.md) Lua module provided by the [lua-resty-core](https://github.com/openresty/lua-resty-core/#readme) library are particularly useful in this context.
3253
+
3254
+
Below is a trivial example using the [ngx.ssl](https://github.com/openresty/lua-resty-core/blob/master/lib/ngx/ssl.md) module and the [ngx.ssl.proxysslcert](https://github.com/openresty/lua-resty-core/blob/master/lib/ngx/ssl/proxysslcert.md) module at the same time:
3255
+
3256
+
```nginx
3257
+
3258
+
server {
3259
+
listen 443 ssl;
3260
+
server_name test.com;
3261
+
ssl_certificate /path/to/cert.crt;
3262
+
ssl_certificate_key /path/to/key.key;
3263
+
3264
+
location /t {
3265
+
proxy_pass https://upstream;
3266
+
3267
+
proxy_ssl_certificate_by_lua_block {
3268
+
local ssl = require "ngx.ssl"
3269
+
local proxy_ssl_cert = require "ngx.ssl.proxysslcert"
3270
+
3271
+
-- NOTE: for illustration only, we don't handle error below
3272
+
3273
+
local f = assert(io.open("/path/to/cert.crt"))
3274
+
local cert_data = f:read("*a")
3275
+
f:close()
3276
+
3277
+
local cert, err = ssl.parse_pem_cert(cert_data)
3278
+
local ok, err = proxy_ssl_cert.set_cert(cert)
3279
+
3280
+
local f = assert(io.open("/path/to/key.key"))
3281
+
local pkey_data = f:read("*a")
3282
+
f:close()
3283
+
3284
+
local pkey, err = ssl.parse_pem_priv_key(pkey_data)
3285
+
local ok, err = proxy_ssl_cert.set_priv_key(pkey)
3286
+
-- ...
3287
+
}
3288
+
}
3289
+
...
3290
+
}
3291
+
```
3292
+
3293
+
See more information in the [ngx.ssl.proxysslcert](https://github.com/openresty/lua-resty-core/blob/master/lib/ngx/ssl/proxysslcert.md) Lua module's official documentation.
3294
+
3295
+
Uncaught Lua exceptions in the user Lua code immediately abort the current SSL session, so does the
3296
+
[ngx.exit](#ngxexit) call with an error code like `ngx.ERROR`.
3297
+
3298
+
This Lua code execution context *does* support yielding, so Lua APIs that may yield (like cosockets, sleeping, and "light threads") are enabled in this context.
3299
+
3300
+
Note that, unlike the relations between the [ssl_certificate](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate) and [ssl_certificate_key](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate_key) directives and [ssl_certificate_by_lua*](#ssl_certificate_by_lua_block), the [proxy_ssl_certificate](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_certificate) and [proxy_ssl_certificate_key](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_certificate_key) directives can be used together with [proxy_ssl_certificate_by_lua*](#proxy_ssl_certificate_by_lua_block).
3301
+
3302
+
* When there are only [proxy_ssl_certificate](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_certificate) and [proxy_ssl_certificate_key](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_certificate_key) directives, the original Nginx behavior will obviously remain the same.
3303
+
3304
+
* When there is only [proxy_ssl_certificate_by_lua*](#proxy_ssl_certificate_by_lua_block), Nginx will send the certificate and its related private key and chain set by Lua codes.
3305
+
3306
+
* When the [proxy_ssl_certificate](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_certificate) and [proxy_ssl_certificate_key](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_certificate_key) directives and [proxy_ssl_certificate_by_lua*](#proxy_ssl_certificate_by_lua_block) are used at the same time, then [proxy_ssl_certificate_by_lua*](#proxy_ssl_certificate_by_lua_block) will take precedence over the [proxy_ssl_certificate](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_certificate) and [proxy_ssl_certificate_key](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_certificate_key) directives.
3307
+
3308
+
Please refer to corresponding test case file and [ngx.ssl.proxysslcert](https://github.com/openresty/lua-resty-core/blob/master/lib/ngx/ssl/proxysslcert.md) for more details.
3309
+
3310
+
Note also that, it has the same condition as the [proxy_ssl_certificate](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_certificate) directive for [proxy_ssl_certificate_by_lua*](#proxy_ssl_certificate_by_lua_block) to work, that is the upstream server should enable verification of client certificates.
3311
+
3312
+
This directive requires OpenSSL 1.0.2e or greater.
Equivalent to [proxy_ssl_certificate_by_lua_block](#proxy_ssl_certificate_by_lua_block), except that the file specified by `<path-to-lua-script-file>` contains the Lua code, or, as from the `v0.5.0rc32` release, the [LuaJIT bytecode](#luajit-bytecode-support) to be executed.
3326
+
3327
+
When a relative path like `foo/bar.lua` is given, they will be turned into the absolute path relative to the `server prefix` path determined by the `-p PATH` command-line option while starting the Nginx server.
0 commit comments