<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 2016-06-23 09:39, Moritz Machner wrote:<br>
<blockquote cite="mid:2B5C8D4D-C4F4-48CA-86E4-61E96F89FB3F@42he.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
Hello, <br class="">
<br class="">
is it possible to dynamical get an cert/key from an database or an
script for SNI? <br class="">
<br class="">
I want to dynamical add new domains with certs for an web app
without changing the config oder restarting nginx:<br class="">
<br class="">
1. get SNI request for domain <a moz-do-not-send="true"
href="http://example342343.com" class="">example342343.com</a> <br
class="">
2. ask mysql for the cert and key for <a moz-do-not-send="true"
href="http://example342343.com" class="">example342343.com</a> <br
class="">
3. start encryption <br class="">
<br class="">
Is that possible? <br class="">
</blockquote>
<br>
Yes, though you would need a bundle called OpenResty (openresty.org)
that comes with nginx, LUA and some patches to make it all work
smoother.<br>
You will lose some features that standard nginx comes with, like
http2.<br>
<br>
I'm working on my own project with it. Though I would recommend
against using MySQL, but consider either a file-based storage with a
shared dictionary inside nginx as cache, and/or use redis as
backend.<br>
There's a few articles on it, I was working on one myself as I'm
going, and it's in no way perfect (plus I made some changes
already):<br>
<br>
<a class="moz-txt-link-freetext" href="https://finalx.nl/display/NG/OpenResty">https://finalx.nl/display/NG/OpenResty</a><br>
<br>
After which I stumbled upon
<a class="moz-txt-link-freetext" href="https://github.com/GUI/lua-resty-auto-ssl">https://github.com/GUI/lua-resty-auto-ssl</a> which basically does
everything I want, and you perhaps as well .. it even uses
letsencrypt.sh to generate certificates and keys on-the-fly when a
request comes in.<br>
<br>
<br>
</body>
</html>