lua-resty-auto-ssl

Read the readme of https://github.com/GUI/lua-resty-auto-ssl/blob/master/README... And tell me what this service can do what resty-auto-ssl can't. And there are a lot of different implementations for every language because it is easy.

Hi, thanks for your reply! The extension I'm using is https://github.com/GUI/lua-resty-auto-ssl. Unfortunately I didn't have any restrictions when I started to test it but I have disabled it for now.

just an FYI for people that host other people's domains dynamically, there is this Openresty ( nginx + lua + other goodies) module that does this automatically, and you can write a custom allow function to fetch "allowed" domains from Redis storage + store the certs in redis (for when you have multiple openresty instances) : https://github.com/GUI/lua-resty-auto-ssl

A great alternative that we use in production for thousands of domains is https://github.com/GUI/lua-resty-auto-ssl

Nginx already has this via OpenResty and a script: https://github.com/GUI/lua-resty-auto-ssl

This is awesome. We're having early success with https://github.com/GUI/lua-resty-auto-ssl + https://openresty.org/ to support thousands of custom domains.

It can be easier. We've used https://github.com/GUI/lua-resty-auto-ssl to provide SSL provisioning on the fly at my previous company for our customers` custom domains. This also means that there is no downtime at all when they change the DNS record from their old servers to the new one

While I do not know the full potential of this, apparently certbot is the way to go for refresh services: https://certbot.eff.org/ In our prod we use https://github.com/GUI/lua-resty-auto-ssl to generate over 1k lets encrypt certs that refresh as they expire. Hope these can help

You can do that with the Lua plugin: https://github.com/GUI/lua-resty-auto-ssl

There is lua-resty-auto-ssl [1] providing exactly that. Sure, it is not plain Nginx, but OpenResty. [1] https://github.com/GUI/lua-resty-auto-ssl

We've set it up in our company with NGINX and LUA (https://github.com/GUI/lua-resty-auto-ssl) and it works great

Yes, by default the module requires that you explicitly whitelist the domains you want to allow certificate registration for. So while you could allow any domain to be registered, that's not recommended for this precise reason. But the whitelist is defined as a Lua function, so you have quite a bit of flexibility in integrating the whitelist logic with other sources of information. See https://github.com/GUI/lua-resty-auto-ssl#precautions and the "allowed_domain" configuration for a bit more detail.

Yes, as long as you're using a shared storage adapter (like Redis), then for the most part, duplicate registration or renewal requests should be handled. The approach to locking we're using is somewhat simplistic (and the specifics depend on the storage adapter you're using), so there might be some rare edge-cases in which 2 requests to Let's Encrypt slip through. However, that shouldn't actually affect the functionality (the last response simply wins). Here's a bit more detail in the code: https://github.com/GUI/lua-resty-auto-ssl/blob/v0.8.2/lib/re...

If you can use OpenResty (nginx+Lua), then that's exactly the approach I've taken for a plugin I've been developing recently (SNI, on-demand, and caching): https://github.com/GUI/lua-resty-auto-ssl There's still a couple loose ends to tie up, but we've been using it on production for a few weeks now, and it's been refreshingly nice to not worry about SSL for new domains. Regarding the 5 requests per week, I believe that's only for repeated re-issuances of the same domain. As long as you cache the certs, then this shouldn't be an issue. Registering new certificates for new domains is limited to 500 per 3 hours: https://community.letsencrypt.org/t/rate-limits-for-lets-enc...