You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by GitBox <gi...@apache.org> on 2020/12/28 16:58:03 UTC
[GitHub] [apisix] highkay opened a new issue #3147: bug: How to config ssl for ip
highkay opened a new issue #3147:
URL: https://github.com/apache/apisix/issues/3147
### Issue description
I have successfully setting sni for some domain, it worked. But right now I need setting sni for ip, I have generated some self signed certs with ip, but get error `failed to find any SSL certificate by SNI: xx.xx.xx.xx, context: ssl_certificate_by_lua*, client: 10.14.0.218, server: 0.0.0.0:9443` . Well I dig the issues and found someone said the sni doesnot support ip. So how can I force to use a self signed cert for ip in apisix just like native nginx.
### Environment
* apisix version 2.1
* OS: apache/apisix:2.1-alpine
* OpenResty / Nginx version:
### Minimal test code / Steps to reproduce the issue
1. generate a self signed cert for ip
2. upload it to apisix via dashboard
3. create a route with an ip for `Domain name`
4. test the route and got error
### What's the actual result? (including assertion message & call stack if applicable)
`failed to find any SSL certificate by SNI: xx.xx.xx.xx, context: ssl_certificate_by_lua*, client: 10.14.0.218, server: 0.0.0.0:9443` in error.log
### What's the expected result?
could work like domain route
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] highkay commented on issue #3147: allow user to configure a fallback SSL cert
Posted by GitBox <gi...@apache.org>.
highkay commented on issue #3147:
URL: https://github.com/apache/apisix/issues/3147#issuecomment-752016953
> You can submit a PR for it.
I would be pleased to if I know some lua staff. And it would be an option to use other gateway software for me if it takes too much time.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] highkay edited a comment on issue #3147: bug: How to config ssl for ip
Posted by GitBox <gi...@apache.org>.
highkay edited a comment on issue #3147:
URL: https://github.com/apache/apisix/issues/3147#issuecomment-751916013
> @highkay What's your configuration about the SSL in APISIX?
```yaml
ssl:
enable: true
enable_http2: true
listen_port: 9443
# ssl_trusted_certificate: /usr/local/apisix/conf/cert # Specifies a file path with trusted CA certificates in the PEM format
# # used to verify the certificate when APISIX needs to do SSL/TLS handshaking
# # with external services (e.g. etcd)
ssl_cert: /usr/local/apisix/conf/cert/root.crt
ssl_cert_key: /usr/local/apisix/conf/cert/root.key
```
the root key is a self signed cert by `mkcert` within a lot private ip.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] spacewander commented on issue #3147: allow user to configure a fallback SSL cert
Posted by GitBox <gi...@apache.org>.
spacewander commented on issue #3147:
URL: https://github.com/apache/apisix/issues/3147#issuecomment-752982388
When `fallback_certificate` is not nil, it means the fallback_certificate is valid.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] highkay commented on issue #3147: allow user to configure a fallback SSL cert
Posted by GitBox <gi...@apache.org>.
highkay commented on issue #3147:
URL: https://github.com/apache/apisix/issues/3147#issuecomment-751924578
This feature could be implemented by reusing the ssl_* setting in yaml, If I am not misunderstanding the config.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] highkay commented on issue #3147: allow user to configure a fallback SSL cert
Posted by GitBox <gi...@apache.org>.
highkay commented on issue #3147:
URL: https://github.com/apache/apisix/issues/3147#issuecomment-752955968
> > If I am not misunderstanding the code you show is about a dns setting item in conf file
>
> You need to check if fallback_certificate is set just like the code check if dns setting is set.
I have done the 1st and 2nd step. The 3rd step confused me, why should I check the fallback_certificate and if I following your guide to define something like "fallback_certificate_valid", then where should I use the "fallback_certificate_valid"? I think it would be somewhere to make "fallback_certificate_valid" effect but I could not catch your meaning.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] highkay commented on issue #3147: allow user to configure a fallback SSL cert
Posted by GitBox <gi...@apache.org>.
highkay commented on issue #3147:
URL: https://github.com/apache/apisix/issues/3147#issuecomment-753330014
> When `fallback_certificate` is not nil, it means the fallback_certificate is valid.
I did the step 1 and 2, and if I can ensure the fallback_certificate set in the step one, I may skip the 3rd step to make the ssl cert work, am I right? I have tried and it doesnot work:(
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] spacewander commented on issue #3147: allow user to configure a fallback SSL cert
Posted by GitBox <gi...@apache.org>.
spacewander commented on issue #3147:
URL: https://github.com/apache/apisix/issues/3147#issuecomment-759970517
I already replied you:
> I think you can submit it as PR, so that we can see why it doesn't work.
APISIX is an open source project. We welcome everyone who contributes to it.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] spacewander commented on issue #3147: allow user to configure a fallback SSL cert
Posted by GitBox <gi...@apache.org>.
spacewander commented on issue #3147:
URL: https://github.com/apache/apisix/issues/3147#issuecomment-752806800
> If I am not misunderstanding the code you show is about a dns setting item in conf file
You need to check if fallback_certificate is set just like the code check if dns setting is set.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] highkay commented on issue #3147: bug: How to config ssl for ip
Posted by GitBox <gi...@apache.org>.
highkay commented on issue #3147:
URL: https://github.com/apache/apisix/issues/3147#issuecomment-751915716
> > Well I dig the issues and found someone said the sni doesnot support ip
>
> The RFC 6066 says "Literal IPv4 and IPv6 addresses are not permitted" in the SNI: https://tools.ietf.org/html/rfc6066
> Even we don't follow the RFC, the client may follow it and do not send SNI when the target is an IP. So support IP at our side doesn't always work.
>
> > use a self signed cert for ip in apisix
>
> What about using a virtual domain like k8s's svc.cluster.local?
I delievered the app in an enviroment in intranet without virtual domain. I just wonder apisix could work like nginx or traefic, setting a default self signed cert for "*".
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] spacewander commented on issue #3147: allow user to configure a fallback SSL cert
Posted by GitBox <gi...@apache.org>.
spacewander commented on issue #3147:
URL: https://github.com/apache/apisix/issues/3147#issuecomment-752006561
You can submit a PR for it.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] highkay commented on issue #3147: allow user to configure a fallback SSL cert
Posted by GitBox <gi...@apache.org>.
highkay commented on issue #3147:
URL: https://github.com/apache/apisix/issues/3147#issuecomment-759956037
anything updated? @spacewander
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] highkay commented on issue #3147: allow user to configure a fallback SSL cert
Posted by GitBox <gi...@apache.org>.
highkay commented on issue #3147:
URL: https://github.com/apache/apisix/issues/3147#issuecomment-752706507
> You can add `fallback_certificate` to `conf/config-default.yaml`, update the
>
> https://github.com/apache/apisix/blob/0597c57b27283f51b365ef74f714151696c5b728/apisix/cli/ops.lua#L233
>
done
>
> And don't call `ngx.exit` in
> https://github.com/apache/apisix/blob/86fa46d85b91ae2604a69aec531b87c276a9a453/apisix/init.lua#L183-L190
>
done
> if it is set. The check code can be like
> https://github.com/apache/apisix/blob/86fa46d85b91ae2604a69aec531b87c276a9a453/apisix/init.lua#L121
what is "The check code" extractly mean? If I am not misunderstanding the code you show is about a dns setting item in conf file. What should I do with it? make it disable?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] spacewander commented on issue #3147: bug: How to config ssl for ip
Posted by GitBox <gi...@apache.org>.
spacewander commented on issue #3147:
URL: https://github.com/apache/apisix/issues/3147#issuecomment-751914665
> Well I dig the issues and found someone said the sni doesnot support ip
The RFC 6066 says "Literal IPv4 and IPv6 addresses are not permitted" in the SNI: https://tools.ietf.org/html/rfc6066
Even we don't follow the RFC, the client may follow it and do not send SNI when the target is an IP. So support IP at our side doesn't always work.
> use a self signed cert for ip in apisix
What about using a virtual domain like k8s's svc.cluster.local?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] highkay commented on issue #3147: allow user to configure a fallback SSL cert
Posted by GitBox <gi...@apache.org>.
highkay commented on issue #3147:
URL: https://github.com/apache/apisix/issues/3147#issuecomment-751999334
@spacewander when the issue could be done? I am looking forward to the feature.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] tokers commented on issue #3147: bug: How to config ssl for ip
Posted by GitBox <gi...@apache.org>.
tokers commented on issue #3147:
URL: https://github.com/apache/apisix/issues/3147#issuecomment-751912947
@highkay What's your configuration about the SSL in APISIX?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] spacewander commented on issue #3147: allow user to configure a fallback SSL cert
Posted by GitBox <gi...@apache.org>.
spacewander commented on issue #3147:
URL: https://github.com/apache/apisix/issues/3147#issuecomment-753881830
I think you can submit it as PR, so that we can see why it doesn't work.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] spacewander commented on issue #3147: bug: How to config ssl for ip
Posted by GitBox <gi...@apache.org>.
spacewander commented on issue #3147:
URL: https://github.com/apache/apisix/issues/3147#issuecomment-751917777
> setting a default self signed cert for "*"
Do you mean setting a cert for all requests regardless of the SNI?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] highkay commented on issue #3147: bug: How to config ssl for ip
Posted by GitBox <gi...@apache.org>.
highkay commented on issue #3147:
URL: https://github.com/apache/apisix/issues/3147#issuecomment-751916013
> @highkay What's your configuration about the SSL in APISIX?
```yaml
ssl:
enable: true
enable_http2: true
listen_port: 9443
# ssl_trusted_certificate: /usr/local/apisix/conf/cert # Specifies a file path with trusted CA certificates in the PEM format
# # used to verify the certificate when APISIX needs to do SSL/TLS handshaking
# # with external services (e.g. etcd)
ssl_cert: /usr/local/apisix/conf/cert/root.crt
ssl_cert_key: /usr/local/apisix/conf/cert/root.key
```
the root key is a self signed cert with `mkcert` within a lot private ip.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] highkay commented on issue #3147: bug: How to config ssl for ip
Posted by GitBox <gi...@apache.org>.
highkay commented on issue #3147:
URL: https://github.com/apache/apisix/issues/3147#issuecomment-751922986
> > setting a default self signed cert for "*"
>
> Do you mean setting a cert for all requests regardless of the SNI?
1. force to use a certain cert for all (include none) sni
2. only reponse to none sni or missing sni
either is ok to me
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] spacewander commented on issue #3147: allow user to configure a fallback SSL cert
Posted by GitBox <gi...@apache.org>.
spacewander commented on issue #3147:
URL: https://github.com/apache/apisix/issues/3147#issuecomment-752039772
You can add `fallback_certificate` to `conf/config-default.yaml`, update the https://github.com/apache/apisix/blob/0597c57b27283f51b365ef74f714151696c5b728/apisix/cli/ops.lua#L233
And don't call `ngx.exit` in https://github.com/apache/apisix/blob/86fa46d85b91ae2604a69aec531b87c276a9a453/apisix/init.lua#L183-L190 if it is set. The check code can be like https://github.com/apache/apisix/blob/86fa46d85b91ae2604a69aec531b87c276a9a453/apisix/init.lua#L121
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] highkay edited a comment on issue #3147: bug: How to config ssl for ip
Posted by GitBox <gi...@apache.org>.
highkay edited a comment on issue #3147:
URL: https://github.com/apache/apisix/issues/3147#issuecomment-751922986
> > setting a default self signed cert for "*"
>
> Do you mean setting a cert for all requests regardless of the SNI?
1. force to use a certain cert for all (include none) sni
2. only reponse to none sni or missing sni
either is ok for me
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] spacewander closed issue #3147: allow user to configure a fallback SSL cert
Posted by GitBox <gi...@apache.org>.
spacewander closed issue #3147:
URL: https://github.com/apache/apisix/issues/3147
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] highkay commented on issue #3147: allow user to configure a fallback SSL cert
Posted by GitBox <gi...@apache.org>.
highkay commented on issue #3147:
URL: https://github.com/apache/apisix/issues/3147#issuecomment-753907313
> I think you can submit it as PR, so that we can see why it doesn't work.
Oh I see. I am misunderstanding your instruction. I must add a new configuration in the conf file in step 1 and do something with it in step 3. But I still not getting what should I do with the `When fallback_certificate is not nil, it means the fallback_certificate is valid.` If it is valid and then?
I am very sorry for distrubing you for plenty of time. I just not familied with openresty and lua staff, and I am not interested in developing some gateway thing right now. I just want to finish my work by operating some mature software.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] highkay commented on issue #3147: allow user to configure a fallback SSL cert
Posted by GitBox <gi...@apache.org>.
highkay commented on issue #3147:
URL: https://github.com/apache/apisix/issues/3147#issuecomment-752085500
thanks, I will try later
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org