Renew failed missing lua_ssl_trusted_certificate in http{} block

[fffonion]

Renew failed missing lua_ssl_trusted_certificate in http{} block

[fffonion]

Hi, you will need to configure trusted CA:

        # required to verify Let's Encrypt API
        lua_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
        lua_ssl_verify_depth 2;

the path is dependent on your OS.

[constantineav]

Hi.
These settings are written initially.

`lua_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
lua_ssl_verify_depth 2;

ssl_certificate /etc/openresty/default.pem;
ssl_certificate_key /etc/openresty/default.key;

ssl_certificate_by_lua_block {
require("resty.acme.autossl").ssl_certificate()
}

location /.well-known {
content_by_lua_block {
require("resty.acme.autossl").serve_http_challenge()
}
}

/ # ls -l /etc/ssl/certs/ca-certificates.crt
-rw-r--r-- 1 root root 231411 Sep 9 13:48 /etc/ssl/certs/ca-certificates.crt
/ #

`

[fffonion]

Ah I see, we will need that two lua_ssl_* directives in http{} block. Since the renewal timer is started in init_worker phase. I'll update the readme. Thanks for spotting this!

[fffonion]

I just updated the readme, feel free to re-open if issue persists.

[constantineav]

taking out to the http level - it works. Thanks. The certificate has been updated.

I see a very strange situation. To exclude any cache in the middle, I make requests locally. But I get different certificates. Here's an example. Requests with a difference of several seconds. The domain is just changed.

root@dev:~# curl -v --resolve somesite:443:127.0.0.1 https://somesite > /dev/stdout 2>&1| grep expire
*        expire date: Tue, 17 Nov 2020 09:27:03 GMT
root@dev:~# curl -v --resolve somesite:443:127.0.0.1 https://somesite > /dev/stdout 2>&1| grep expire
*        expire date: Tue, 09 Feb 2021 15:33:24 GMT
root@dev:~# curl -v --resolve somesite:443:127.0.0.1 https://somesite > /dev/stdout 2>&1| grep expire
*        expire date: Tue, 17 Nov 2020 09:27:03 GMT
root@dev:~# curl -v --resolve somesite:443:127.0.0.1 https://somesite > /dev/stdout 2>&1| grep expire
*        expire date: Tue, 17 Nov 2020 09:27:03 GMT
root@dev:~# curl -v --resolve somesite:443:127.0.0.1 https://somesite > /dev/stdout 2>&1| grep expire
*        expire date: Tue, 17 Nov 2020 09:27:03 GMT
root@dev:~# curl -v --resolve somesite:443:127.0.0.1 https://somesite > /dev/stdout 2>&1| grep expire
*        expire date: Tue, 09 Feb 2021 15:33:24 GMT

[fffonion]

@constantineav There's a cache of 1 hr, we don't actively invalidate cache right now. This can be improvement.

[wangyp0701]

Can I renew the certificate automatically after it has expired ? @fffonion

[fffonion]

@wangyp0701 yes

[wangyp0701]

I have multiple domain names that have expired, but they have not been renewed automatically. I deleted the redis key of one of them and regenerated a new certificate @fffonion

[fffonion]

@wangyp0701 Which version of library are you using? Let's also open a new issue instead of discussing in a closed one.

[wangyp0701]

All expired certificates are updated at zero