How to fix lua ssl certificate verify error?

[yurevich1]

If I use
local http = require("resty.http").new()
local res, err = http:request_uri(url, {
method = method,
headers = headers,
body = body
})

without ssl_verify = false for https, I receive
lua ssl certificate verify error: (20: unable to get local issuer certificate),
how to setup nginx.conf in a proper way it order to use ssl_verify = true?

[didip]

I have this exact problem as well. How to configure the http client to verify hostname when using SSL?

[yurevich1]

@didip I have no found a solution :(

[hamishforbes]

This isn't really anything to do with resty-http, you need to configure Openresty / ngx_lua correctly to allow the underlying feature to do ssl verification.
See here: https://github.com/openresty/lua-nginx-module#tcpsocksslhandshake

[JewelPengin]

So I've been under the inclination to use the following https://github.com/openresty/lua-nginx-module#lua_ssl_trusted_certificate. That being said, I have yet to make it work out of the box as well. I get the same message as mentioned above.

[hamishforbes]

Yep, you need to set lua_ssl_trusted_certificate to a file containing CA root certs.
For example on RedHat systems the system provided CA certs are at /etc/pki/tls/cert.pem

You might also need to increase lua_ssl_verify_depth beyond its default of 1.

[steve-chavez]

Managed to sort this out in openresty/openresty:jessie docker container by doing:

## In Dockerfile
RUN cp /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.pem
## Then in nginx.conf
lua_ssl_verify_depth 2;
lua_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.pem;

[fractos]

@steve-chavez Fantastic, thanks for that - worked perfectly.

[taf2]

what about when using resty on the command line?

i tried like:

resty --main-conf 'lua_ssl_verify_depth 2;lua_ssl_trusted_certificate /usr/local/etc/openssl/cert.pem;'

but that gives

nginx: [emerg] "lua_ssl_verify_depth" directive is not allowed here in /tmp/resty_KTiSmqiccD/conf/nginx.conf:110

[edit]

resty --http-conf 'lua_ssl_verify_depth 2;lua_ssl_trusted_certificate /usr/local/etc/openssl/cert.pem;'

switch main to http and it works!

[karl-chanel]

marked