Control Nginx SSL/SNI with Lua

[miracle2k]

I'd like to run some LUA to support multiple frontends with different SSL certificates, ideally via SNI. I will need to execute my Lua code before the SSL is decoded (and make it use the correct certificate).

I gather this is not supported?

[agentzh]

@miracle2k No. This requires patching nginx I guess :)

[miracle2k]

I was hoping that nginx might have a plugin hook that lua-nginx could expose.

Of course, if this isn't a thing that realistically is going to happen, we can close the ticket.

[bearnard]

I'd really have liked this to be possible without patching nginx.

@agentzh could you elaborate a bit?
I'm assuming there is no exposed "phase" during ssl negotiations that nginx-lua could tap into?

There are alternative "ways" of doing similar things outside of nginx e.g: https://github.com/dlundquist/sniproxy

[agentzh]

@bearnard Yeah, it's good to have. Maybe we could ask the Nginx team to add a hook for us :)

[rkearsley]

Hi
I'm very interested in this too. The current solution of having to have a separate server {} in the nginx config is very tedious to automate since nginx has to be restarted for every change.
I would much prefer to automate this with Lua!

I will start a thread on nginx mailing list to hopefully get an nginx hook added.. It will just highlight the problem, hopefully you guys can add your support and suggestions in response to it..

Thanks
Richard

[agentzh]

@rkearsley yeah we need more voices from the community. I actually talked about it with some guys on the nginx team in person a few weeks ago. But to change their priority, we really need more voices.

[Shananra]

I need this feature as well. It would be nice to just drop the certificate and key files into a specified directory and have lua just start using them without using scripts to rebuild the config and restart nginx, which is what I'm currently doing.

[agentzh]

@Shananra I'll try to patch the nginx core to have the hooks required by ngx_lua (and other nginx C modules) :)

[agentzh]

I do have plans to add hooks to the nginx core and implement directives like ssl_verify_by_lua and ssl_verify_by_lua_file in ngx_lua in the next 6 months or so.

[Shananra]

@agentzh Awesome. Thanks a ton for doing that.

[agentzh]

The directive names are going to be ssl_certificate_by_lua and ssl_certificate_by_lua_file. I've got my first nontrivial test case working locally. I'll continue maturing it in the next 5 months or so.

[bearnard]

\o/

[bearnard]

@agentzh let me know if I can help out with testing etc...

[agentzh]

@bearnard Sure, I'll let you know.

[chrisboulton]

@agentzh We're very excited by the possibility of this too. I'd definitely be interested in helping out or testing in any way I can.