$ show auto-ssl/lua-resty-auto-ssl
lua-resty-auto-ssl is an OpenResty (nginx + Lua) plugin that automatically issues and renews SSL/TLS certificates from Let's Encrypt (ACME) on the fly. It intercepts the SSL handshake via ssl_certificate_by_lua, checks for existing certificates in shared memory or persistent storage (file or Redis), and if missing, triggers certificate issuance using the dehydrated shell client. Domain validation is handled automatically via HTTP-01 challenges. The plugin supports multiple nginx workers, distributed storage, OCSP stapling, and configurable domain allow/deny policies. It is designed for high-traffic production environments but has been explicitly abandoned by its maintainers, with no active development since 2019. The codebase is well-structured with modular storage adapters, JSON adapters, and locking mechanisms, but relies on external shell processes (sockproc) and the dehydrated script, making it difficult to maintain and prone to issues with modern Let's Encrypt API changes. Given its abandoned status, it is not recommended for new projects; users should consider alternatives like acme.sh, acme-companion, or win-acme.
The LLM identified 2 files worth highlighting for reuse:
Provides a clean abstraction layer over different storage backends (file, Redis) for persisting SSL certificates and ACME challenges. It implements a distributed locking mechanism to prevent concurrent certificate issuance across multiple servers. The interface (get/set/delete for certs and challenges, all_cert_domains, issue_cert_lock/unlock) is minimal and well-defined, making it reusable in other ACME client implementations or any application needing a pluggable key-value store with locking.
Parses the ASN1_TIME_print output from OpenSSL into a Unix epoch timestamp without relying on Lua's os.time (which is timezone-dependent). It correctly handles all calendar dates from year -8000 to 2400, including leap years and century rules, and is immune to local timezone settings. This utility is self-contained (only depends on ngx.re.match), thoroughly tested, and can be extracted directly into any Lua/OpenResty project that needs to convert OpenSSL date strings to numeric timestamps.