You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "praswicaksono (via GitHub)" <gi...@apache.org> on 2024/12/19 10:34:52 UTC
[I] [RFC] Implement ACME Automatic SSL for Apache APISIX Gateway [apisix]
praswicaksono opened a new issue, #11845:
URL: https://github.com/apache/apisix/issues/11845
### Description
# Introduction
This RFC proposes the implementation of ACME (Automatic Certificate Management Environment) to automate the process of obtaining and renewing SSL/TLS certificates for the Apache APISIX Gateway. This will enhance security by ensuring that all communications are encrypted and up-to-date with minimal manual intervention.
# Motivation
Currently, managing SSL certificates for the Apache APISIX Gateway involves manual processes that are prone to errors and can lead to downtime if certificates expire. By integrating ACME, we can automate this process, reducing the risk of expired certificates and improving the overall security posture.
# Proposal
Introducing new way to automatically manage SSL certificate, this proposal intend to not make any modification to current process to manage certificate. Let user decide how they want to manage certificate via `yaml` config
This proposal will use this library to automatically handle certificate management. This library support multiple storage backend such as etcd or local file.
- https://github.com/fffonion/lua-resty-acme
Example implementation
config
```yaml
apisix:
ssl:
automatic: true
acme:
some-comfig:
```
ngx template
```
{% if acme_enabled then %}
ssl_certificate_by_lua_block {
require("resty.acme.autossl").ssl_certificate()
}
location /.well-known {
content_by_lua_block {
require("resty.acme.autossl").serve_http_challenge()
}
}
{% else %}
ssl_client_hello_by_lua_block {
apisix.http_ssl_client_hello_phase()
}
ssl_certificate_by_lua_block {
apisix.http_ssl_phase()
}
{% end %}
```
## Pros
- No need to create bash script to generate SSL certificate and update via admin api
- Fully automatic including automatic renewal
## Cons
- Only able to use one method to manage SSL certificate, either it manual or automatic
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [RFC] Implement ACME Automatic SSL for Apache APISIX Gateway [apisix]
Posted by "Horus-K (via GitHub)" <gi...@apache.org>.
Horus-K commented on issue #11845:
URL: https://github.com/apache/apisix/issues/11845#issuecomment-3409989158
How do I use ACME (cert-manager) in standalone apisix mode in Kubernetes?
I typically use apisix-ingress-controller (ApisixRoute) to specify routes. How do I use annotations like cert-manager.io/cluster-issuer: letsencrypt to automatically renew certificates?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [RFC] Implement ACME Automatic SSL for Apache APISIX Gateway [apisix]
Posted by "praswicaksono (via GitHub)" <gi...@apache.org>.
praswicaksono commented on issue #11845:
URL: https://github.com/apache/apisix/issues/11845#issuecomment-2560961781
@membphis I see so you are suggesting to support ACME in same way we support referencing certificate via vault?
For example if we want to to enable acme we must create SSL record
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [RFC] Implement ACME Automatic SSL for Apache APISIX Gateway [apisix]
Posted by "juzhiyuan (via GitHub)" <gi...@apache.org>.
juzhiyuan closed issue #11845: [RFC] Implement ACME Automatic SSL for Apache APISIX Gateway
URL: https://github.com/apache/apisix/issues/11845
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [RFC] Implement ACME Automatic SSL for Apache APISIX Gateway [apisix]
Posted by "yuweizzz (via GitHub)" <gi...@apache.org>.
yuweizzz commented on issue #11845:
URL: https://github.com/apache/apisix/issues/11845#issuecomment-6051810254
I implemented this feature as a plugin. If anyone needs it, feel free to give it a try!
https://github.com/yuweizzz/apisix-plugin-acme
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [RFC] Implement ACME Automatic SSL for Apache APISIX Gateway [apisix]
Posted by "juzhiyuan (via GitHub)" <gi...@apache.org>.
juzhiyuan commented on issue #11845:
URL: https://github.com/apache/apisix/issues/11845#issuecomment-6082320323
Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [RFC] Implement ACME Automatic SSL for Apache APISIX Gateway [apisix]
Posted by "membphis (via GitHub)" <gi...@apache.org>.
membphis commented on issue #11845:
URL: https://github.com/apache/apisix/issues/11845#issuecomment-2565245809
you can take a at: https://docs.konghq.com/hub/kong-inc/acme
fetch the latest certificates by control API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [RFC] Implement ACME Automatic SSL for Apache APISIX Gateway [apisix]
Posted by "alibabakhanlu12 (via GitHub)" <gi...@apache.org>.
alibabakhanlu12 commented on issue #11845:
URL: https://github.com/apache/apisix/issues/11845#issuecomment-2780356271
Any update on this issue?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [RFC] Implement ACME Automatic SSL for Apache APISIX Gateway [apisix]
Posted by "membphis (via GitHub)" <gi...@apache.org>.
membphis commented on issue #11845:
URL: https://github.com/apache/apisix/issues/11845#issuecomment-2558825847
@praswicaksono I carefully review your proposal. There are one basic question we need to answer first.
> Only able to use one method to manage SSL certificate, either it manual or automatic
I think this is unacceptable, here is my explanation:
The APISIX had supported those cases at same time:
1. Allow to store the SSL certificates in the etcd(set through by Admin API): https://apisix.apache.org/docs/apisix/ssl-protocol/#examples
2. Allow to reference the SSL certificates from the ENV: https://apisix.apache.org/docs/apisix/terminology/secret/#use-environment-variables-to-manage-secrets
3. Allow to reference the SSL certificates from the Vault: https://apisix.apache.org/blog/2023/07/09/apisix-integrates-with-vault/#deploy-and-configure-vault-service
In my opinion, those are the thing we should do:
1. Support ACME, it is ok
2. Allows ACME to be used with other SSL certificate management methods at the same time, it should be ok too
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [RFC] Implement ACME Automatic SSL for Apache APISIX Gateway [apisix]
Posted by "philipsens (via GitHub)" <gi...@apache.org>.
philipsens commented on issue #11845:
URL: https://github.com/apache/apisix/issues/11845#issuecomment-3841320485
> How do I use ACME (cert-manager) in standalone apisix mode in Kubernetes? I typically use apisix-ingress-controller (ApisixRoute) to specify routes. How do I use annotations like cert-manager.io/cluster-issuer: letsencrypt to automatically renew certificates?
Same as for NGINX:
```yaml
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: lets-encrypt-apisix
namespace: cert-manager
spec:
acme:
# Replace the email address with your own contact email
email:
# The server is replaced in overlays
server: https://acme-staging-v02.api.letsencrypt.org/directory
privateKeySecretRef:
name: lets-encrypt-apisix
solvers:
- http01:
ingress:
ingressClassName: apisix
```
Annotation would be `cert-manager.io/cluster-issuer: lets-encrypt-apisix` for this config.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org