Drive-by SSL certificate creation with nginx
summary
Demonstrates nginx+Lua producing real SSL certificates on the fly: Lua + OpenSSL APIs generate keypairs, build CSRs, sign with a local CA, and inject cert/key into nginx’s SSL context using the Cloudflare-contributed patch. Build uses OpenResty/LuaJIT, a patched nginx core and nonblocking cosockets for backend calls. Demo runs in Vagrant, validates via SNI and a locally trusted CA, and works, though per-request cert issuance is slow and required fixes (OpenSSL serial handling, config reload hygiene). Uses OpenResty and shows pitfalls of ad hoc generation.
AI-written summary · about
chapters (34)
- 0:00Introduction
- 1:25Why nginx
- 3:25About nginx
- 5:05nginx is like Batman
- 6:48Thirdparty modules
- 9:27Lua
- 14:04Lua cheat
- 16:44nginx Lua
- 19:36nginx configuration
- 20:09nginx development
- 21:09nginx Lua API
- 24:48nginx capture
- 27:03nonblocking socket
- 27:59UDP connection
- 29:13Work offload
- 30:47Capture CoSocket
- 31:46OpenResi make
- 32:59OpenResi modules
- 33:40OpenResi testing
- 34:04Lua Rocks
- 34:26Get used to it
- 34:36kongkong
- 37:00crime prevention
- 37:42SSL by Lua
- 38:04OpenResi patch
- 39:24Cloudfair
- 41:20Demo
- 46:49Code
- 49:08Certificate request
- 50:53Certificate creation
- 53:09C code issues
- 53:22Secure Secure
- 53:50Tips Tricks
- 57:20Questions
related talks
41mDirty Tricks: Using nginx and Lua to thwart bots and skript kiddies
26mSSL all the things
42mLet's go HTTPS
58mSecure Networking with SSL
11mACME TLS-SNI-01 issuing Let's Encrypt SSL-certs for any domain using shared hosting
25mSSL All The Things
06mIgnite: Monitoring and maintaining self-signed certificates is dangerous
32mImplementing Zero Trust