You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by GitBox <gi...@apache.org> on 2021/05/24 09:00:32 UTC
[GitHub] [apisix] anjia0532 opened a new pull request #4297: 基于acme.sh自动更新apisix ssl证书
anjia0532 opened a new pull request #4297:
URL: https://github.com/apache/apisix/pull/4297
### What this PR does / why we need it:
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->
### Pre-submission checklist:
* [ ] Did you explain what problem does this PR solve? Or what new features have been added?
* [ ] Have you added corresponding test cases?
* [ ] Have you modified the corresponding document?
* [ ] Is this PR backward compatible? **If it is not backward compatible, please discuss on the [mailing list](https://github.com/apache/apisix/tree/master#community) first**
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] anjia0532 commented on a change in pull request #4297: docs: show how to auto renew SSL cert via acme.sh
Posted by GitBox <gi...@apache.org>.
anjia0532 commented on a change in pull request #4297:
URL: https://github.com/apache/apisix/pull/4297#discussion_r637871693
##########
File path: docs/zh/latest/FAQ.md
##########
@@ -486,3 +486,17 @@ apisix:
重启或 reload APISIX，所有 IP 便可以访问 `Admin API`。
**注意：您可以在非生产环境中使用此方法，以允许所有客户端从任何地方访问您的 `Apache APISIX` 实例，但是在生产环境中使用它并不安全。在生产环境中，请仅授权特定的 IP 地址或地址范围访问您的实例。**
+
+## 基于acme.sh自动更新apisix ssl证书
+
+```bash
+$ curl --output /root/.acme.sh/renew-hook-update-apisix.sh --silent https://gist.githubusercontent.com/anjia0532/9ebf8011322f43e3f5037bc2af3aeaa6/raw/65b359a4eed0ae990f9188c2afa22bacd8471652/renew-hook-update-apisix.sh
+
+$ chmod +x /root/.acme.sh/renew-hook-update-apisix.sh
+
+$ acme.sh --issue --staging -d demo.domain --renew-hook "~/.acme.sh/renew-hook-update-apisix.sh -h http://apisix-admin:port -p /root/.acme.sh/demo.domain/demo.domain.cer -k /root/.acme.sh/demo.domain/demo.domain.key -a xxxxxxxxxxxxx"
Review comment:
Translate my blog or this PR?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] spacewander merged pull request #4297: docs: show how to auto renew SSL cert via acme.sh
Posted by GitBox <gi...@apache.org>.
spacewander merged pull request #4297:
URL: https://github.com/apache/apisix/pull/4297
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] anjia0532 commented on a change in pull request #4297: docs: show how to auto renew SSL cert via acme.sh
Posted by GitBox <gi...@apache.org>.
anjia0532 commented on a change in pull request #4297:
URL: https://github.com/apache/apisix/pull/4297#discussion_r638377010
##########
File path: docs/zh/latest/FAQ.md
##########
@@ -486,3 +486,18 @@ apisix:
重启或 reload APISIX，所有 IP 便可以访问 `Admin API`。
**注意：您可以在非生产环境中使用此方法，以允许所有客户端从任何地方访问您的 `Apache APISIX` 实例，但是在生产环境中使用它并不安全。在生产环境中，请仅授权特定的 IP 地址或地址范围访问您的实例。**
+
+## 基于 acme.sh 自动更新 apisix ssl 证书
+
+```bash
+$ curl --output /root/.acme.sh/renew-hook-update-apisix.sh --silent https://gist.githubusercontent.com/anjia0532/9ebf8011322f43e3f5037bc2af3aeaa6/raw/65b359a4eed0ae990f9188c2afa22bacd8471652/renew-hook-update-apisix.sh
+
+$ chmod +x /root/.acme.sh/renew-hook-update-apisix.sh
+
+$ acme.sh --issue --staging -d demo.domain --renew-hook "~/.acme.sh/renew-hook-update-apisix.sh -h http://apisix-admin:port -p /root/.acme.sh/demo.domain/demo.domain.cer -k /root/.acme.sh/demo.domain/demo.domain.key -a xxxxxxxxxxxxx"
+
+$ acme.sh --renew --domain demo.domain
+
+```
+
+详细步骤，可以参考我的博客 https://juejin.cn/post/6965778290619449351
Review comment:
done
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] anjia0532 commented on a change in pull request #4297: docs: show how to auto renew SSL cert via acme.sh
Posted by GitBox <gi...@apache.org>.
anjia0532 commented on a change in pull request #4297:
URL: https://github.com/apache/apisix/pull/4297#discussion_r637875530
##########
File path: docs/zh/latest/FAQ.md
##########
@@ -486,3 +486,17 @@ apisix:
重启或 reload APISIX，所有 IP 便可以访问 `Admin API`。
**注意：您可以在非生产环境中使用此方法，以允许所有客户端从任何地方访问您的 `Apache APISIX` 实例，但是在生产环境中使用它并不安全。在生产环境中，请仅授权特定的 IP 地址或地址范围访问您的实例。**
+
+## 基于acme.sh自动更新apisix ssl证书
+
+```bash
+$ curl --output /root/.acme.sh/renew-hook-update-apisix.sh --silent https://gist.githubusercontent.com/anjia0532/9ebf8011322f43e3f5037bc2af3aeaa6/raw/65b359a4eed0ae990f9188c2afa22bacd8471652/renew-hook-update-apisix.sh
+
+$ chmod +x /root/.acme.sh/renew-hook-update-apisix.sh
+
+$ acme.sh --issue --staging -d demo.domain --renew-hook "~/.acme.sh/renew-hook-update-apisix.sh -h http://apisix-admin:port -p /root/.acme.sh/demo.domain/demo.domain.cer -k /root/.acme.sh/demo.domain/demo.domain.key -a xxxxxxxxxxxxx"
Review comment:
@spacewander added zh and en doc
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] spacewander commented on a change in pull request #4297: docs: show how to auto renew SSL cert via acme.sh
Posted by GitBox <gi...@apache.org>.
spacewander commented on a change in pull request #4297:
URL: https://github.com/apache/apisix/pull/4297#discussion_r638387573
##########
File path: docs/en/latest/FAQ.md
##########
@@ -487,3 +487,20 @@ apisix:
Restart or reload APISIX, all IPs can access the `Admin API`.
**Note: You can use this method in a non-production environment to allow all clients from anywhere to access your `Apache APISIX` instances, but it is not safe to use it in a production environment. In production environment, please only authorize specific IP addresses or address ranges to access your instance.**
+
Review comment:
Please remove extra blank lines
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] spacewander commented on a change in pull request #4297: 基于acme.sh自动更新apisix ssl证书
Posted by GitBox <gi...@apache.org>.
spacewander commented on a change in pull request #4297:
URL: https://github.com/apache/apisix/pull/4297#discussion_r637870242
##########
File path: docs/zh/latest/FAQ.md
##########
@@ -486,3 +486,17 @@ apisix:
重启或 reload APISIX，所有 IP 便可以访问 `Admin API`。
**注意：您可以在非生产环境中使用此方法，以允许所有客户端从任何地方访问您的 `Apache APISIX` 实例，但是在生产环境中使用它并不安全。在生产环境中，请仅授权特定的 IP 地址或地址范围访问您的实例。**
+
+## 基于acme.sh自动更新apisix ssl证书
+
+```bash
+$ curl --output /root/.acme.sh/renew-hook-update-apisix.sh --silent https://gist.githubusercontent.com/anjia0532/9ebf8011322f43e3f5037bc2af3aeaa6/raw/65b359a4eed0ae990f9188c2afa22bacd8471652/renew-hook-update-apisix.sh
+
+$ chmod +x /root/.acme.sh/renew-hook-update-apisix.sh
+
+$ acme.sh --issue --staging -d demo.domain --renew-hook "~/.acme.sh/renew-hook-update-apisix.sh -h http://apisix-admin:port -p /root/.acme.sh/demo.domain/demo.domain.cer -k /root/.acme.sh/demo.domain/demo.domain.key -a xxxxxxxxxxxxx"
Review comment:
I see. Could you provide an English version via an online translator like Youdao?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] anjia0532 commented on a change in pull request #4297: 基于acme.sh自动更新apisix ssl证书
Posted by GitBox <gi...@apache.org>.
anjia0532 commented on a change in pull request #4297:
URL: https://github.com/apache/apisix/pull/4297#discussion_r637832360
##########
File path: docs/zh/latest/FAQ.md
##########
@@ -486,3 +486,17 @@ apisix:
重启或 reload APISIX，所有 IP 便可以访问 `Admin API`。
**注意：您可以在非生产环境中使用此方法，以允许所有客户端从任何地方访问您的 `Apache APISIX` 实例，但是在生产环境中使用它并不安全。在生产环境中，请仅授权特定的 IP 地址或地址范围访问您的实例。**
+
+## 基于acme.sh自动更新apisix ssl证书
+
+```bash
+$ curl --output /root/.acme.sh/renew-hook-update-apisix.sh --silent https://gist.githubusercontent.com/anjia0532/9ebf8011322f43e3f5037bc2af3aeaa6/raw/65b359a4eed0ae990f9188c2afa22bacd8471652/renew-hook-update-apisix.sh
+
+$ chmod +x /root/.acme.sh/renew-hook-update-apisix.sh
+
+$ acme.sh --issue --staging -d demo.domain --renew-hook "~/.acme.sh/renew-hook-update-apisix.sh -h http://apisix-admin:port -p /root/.acme.sh/demo.domain/demo.domain.cer -k /root/.acme.sh/demo.domain/demo.domain.key -a xxxxxxxxxxxxx"
Review comment:
1. 为何提这个PR，源于这个issues https://github.com/apache/apisix/issues/3841#issuecomment-844628829
2. 这是一个常见的需求或者特性，目前apisix不支持自动续期或者更新ssl
3. 改动源码比较麻烦而用acme.sh的hook特性来实现会比较容易，而acme.sh也是比较常见的开源软件，所以才写了一个脚本
很抱歉我的英文不太好，为了不引起一些误会或者歧义，使用中文回复。
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] Firstsawyou commented on a change in pull request #4297: docs: show how to auto renew SSL cert via acme.sh
Posted by GitBox <gi...@apache.org>.
Firstsawyou commented on a change in pull request #4297:
URL: https://github.com/apache/apisix/pull/4297#discussion_r638689193
##########
File path: docs/en/latest/FAQ.md
##########
@@ -487,3 +487,18 @@ apisix:
Restart or reload APISIX, all IPs can access the `Admin API`.
**Note: You can use this method in a non-production environment to allow all clients from anywhere to access your `Apache APISIX` instances, but it is not safe to use it in a production environment. In production environment, please only authorize specific IP addresses or address ranges to access your instance.**
+
+## how to auto renew SSL cert via acme.sh
Review comment:
The title should be better like this:
```suggestion
## How to auto renew SSL cert via acme.sh
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] spacewander commented on a change in pull request #4297: 基于acme.sh自动更新apisix ssl证书
Posted by GitBox <gi...@apache.org>.
spacewander commented on a change in pull request #4297:
URL: https://github.com/apache/apisix/pull/4297#discussion_r637806261
##########
File path: docs/zh/latest/FAQ.md
##########
@@ -486,3 +486,17 @@ apisix:
重启或 reload APISIX，所有 IP 便可以访问 `Admin API`。
**注意：您可以在非生产环境中使用此方法，以允许所有客户端从任何地方访问您的 `Apache APISIX` 实例，但是在生产环境中使用它并不安全。在生产环境中，请仅授权特定的 IP 地址或地址范围访问您的实例。**
+
+## 基于acme.sh自动更新apisix ssl证书
+
+```bash
+$ curl --output /root/.acme.sh/renew-hook-update-apisix.sh --silent https://gist.githubusercontent.com/anjia0532/9ebf8011322f43e3f5037bc2af3aeaa6/raw/65b359a4eed0ae990f9188c2afa22bacd8471652/renew-hook-update-apisix.sh
+
+$ chmod +x /root/.acme.sh/renew-hook-update-apisix.sh
+
+$ acme.sh --issue --staging -d demo.domain --renew-hook "~/.acme.sh/renew-hook-update-apisix.sh -h http://apisix-admin:port -p /root/.acme.sh/demo.domain/demo.domain.cer -k /root/.acme.sh/demo.domain/demo.domain.key -a xxxxxxxxxxxxx"
Review comment:
I think it would be more suitable to be a blog instead of a FAQ answer?
This feature is not part of APISIX.
We can refer to the blog in this section:
https://github.com/apache/apisix#videos-and-articles
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] Yiyiyimu commented on a change in pull request #4297: docs: show how to auto renew SSL cert via acme.sh
Posted by GitBox <gi...@apache.org>.
Yiyiyimu commented on a change in pull request #4297:
URL: https://github.com/apache/apisix/pull/4297#discussion_r638215169
##########
File path: docs/zh/latest/FAQ.md
##########
@@ -486,3 +486,18 @@ apisix:
重启或 reload APISIX，所有 IP 便可以访问 `Admin API`。
**注意：您可以在非生产环境中使用此方法，以允许所有客户端从任何地方访问您的 `Apache APISIX` 实例，但是在生产环境中使用它并不安全。在生产环境中，请仅授权特定的 IP 地址或地址范围访问您的实例。**
+
+## 基于 acme.sh 自动更新 apisix ssl 证书
+
+```bash
+$ curl --output /root/.acme.sh/renew-hook-update-apisix.sh --silent https://gist.githubusercontent.com/anjia0532/9ebf8011322f43e3f5037bc2af3aeaa6/raw/65b359a4eed0ae990f9188c2afa22bacd8471652/renew-hook-update-apisix.sh
+
+$ chmod +x /root/.acme.sh/renew-hook-update-apisix.sh
+
+$ acme.sh --issue --staging -d demo.domain --renew-hook "~/.acme.sh/renew-hook-update-apisix.sh -h http://apisix-admin:port -p /root/.acme.sh/demo.domain/demo.domain.cer -k /root/.acme.sh/demo.domain/demo.domain.key -a xxxxxxxxxxxxx"
+
+$ acme.sh --renew --domain demo.domain
+
+```
+
+详细步骤，可以参考我的博客 https://juejin.cn/post/6965778290619449351
Review comment:
It might not be appropriate to use `我的博客` in a public repo.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] spacewander commented on a change in pull request #4297: docs: show how to auto renew SSL cert via acme.sh
Posted by GitBox <gi...@apache.org>.
spacewander commented on a change in pull request #4297:
URL: https://github.com/apache/apisix/pull/4297#discussion_r637870972
##########
File path: docs/zh/latest/FAQ.md
##########
@@ -486,3 +486,17 @@ apisix:
重启或 reload APISIX，所有 IP 便可以访问 `Admin API`。
**注意：您可以在非生产环境中使用此方法，以允许所有客户端从任何地方访问您的 `Apache APISIX` 实例，但是在生产环境中使用它并不安全。在生产环境中，请仅授权特定的 IP 地址或地址范围访问您的实例。**
+
+## 基于acme.sh自动更新apisix ssl证书
Review comment:
```suggestion
## 基于 acme.sh 自动更新 APISIX SSL 证书
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] anjia0532 commented on a change in pull request #4297: 基于acme.sh自动更新apisix ssl证书
Posted by GitBox <gi...@apache.org>.
anjia0532 commented on a change in pull request #4297:
URL: https://github.com/apache/apisix/pull/4297#discussion_r637832360
##########
File path: docs/zh/latest/FAQ.md
##########
@@ -486,3 +486,17 @@ apisix:
重启或 reload APISIX，所有 IP 便可以访问 `Admin API`。
**注意：您可以在非生产环境中使用此方法，以允许所有客户端从任何地方访问您的 `Apache APISIX` 实例，但是在生产环境中使用它并不安全。在生产环境中，请仅授权特定的 IP 地址或地址范围访问您的实例。**
+
+## 基于acme.sh自动更新apisix ssl证书
+
+```bash
+$ curl --output /root/.acme.sh/renew-hook-update-apisix.sh --silent https://gist.githubusercontent.com/anjia0532/9ebf8011322f43e3f5037bc2af3aeaa6/raw/65b359a4eed0ae990f9188c2afa22bacd8471652/renew-hook-update-apisix.sh
+
+$ chmod +x /root/.acme.sh/renew-hook-update-apisix.sh
+
+$ acme.sh --issue --staging -d demo.domain --renew-hook "~/.acme.sh/renew-hook-update-apisix.sh -h http://apisix-admin:port -p /root/.acme.sh/demo.domain/demo.domain.cer -k /root/.acme.sh/demo.domain/demo.domain.key -a xxxxxxxxxxxxx"
Review comment:
https://github.com/apache/apisix/issues/3841#issuecomment-844628829
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org