Today I’d like to show how to upload your own SSL certificates to your HTTPS applications in OpenResty Edge.
As always, let’s go to the OpenResty Edge’s Admin web console. This is our sample deployment of the console. Every user has her own local deployment.
This time we use our continuing sample application for the test-edge.com domain.
We can see that it already listens on the 443 port for SSL.
Let’s enter this application.
Goto the SSL page.
We can see that there are no SSL certificates defined yet.
Let’s add a new certificate.
We support various ways to add a new SSL certificate, including Let’s Encrypt.
Here we’d just demonstrate the manual uploading way.
We can copy and paste our SSL private key in the PEM format here.
We could browse the local file system and upload a local file instead.
And also paste the corresponding SSL certificate in the PEM format.
Again, we could browse and upload a local certificate file instead.
Sometimes the CA may provide a separate file containing intermediate trusted CA certificate chain.
But more often the chain is already included in the server certificate file here.
We leave it blank for this example since we don’t have any.
Save our certificate and key pair.
We can see the record for our newly created certificate and key pair.
The certificate issuing source is manual upload.
And the certificate is for a single domain, test-edge.com.
And it will expire in about a year.
We can see the exact expiration time by hovering the mouse over it.
We can also edit an existing certificate.
We don’t make any changes here.
Or we can delete this certificate.
We don’t want to delete it now.
We can also disable a certificate without removing it.
We need to make a new release to push out our new certificate, as always.
Click on this button.
It is done now!
Now the new certificate has been pushed to all the gateway clusters and servers.
Our configuration changes do NOT require server reload, restart, or binary upgrade. So it’s very efficient and scalable.
Then we can pick up a gateway cluster server to test our new certificate.
We choose a gateway server here near San Francisco.
Copy its public IP address ending with 133.
On the terminal, we can send an HTTPS request to this gateway server.
curl -I --resolve 'test-edge.com:443:220.127.116.11' https://test-edge.com/
We can check more details like the certificate information via the
curl -I --resolve 'test-edge.com:443:18.104.22.168' https://test-edge.com/ -v 2>&1 | less -n
We can indeed see our server certificate here.
SSL certificate uploading can also be automated by OpenResty Edge’s REST API. We will demonstrate it in another video.
This is what I’d love to cover today.
Yichun Zhang is the creator of the OpenResty® open source project. He is also the founder and CEO of the OpenResty Inc. company. He contributed a dozen open source Nginx 3rd-party modules, quite some Nginx and LuaJIT core patches, and designed products like OpenResty Edge, OpenResty XRay, and OpenResty Showman.
We provide the Chinese translation for this article on blog.openresty.com.cn. We welcome interested readers to contribute translations in other natural languages as long as the full article is translated without any omissions. We thank them in advance.
We always welcome talented and enthusiastic engineers to join our team at OpenResty Inc.
to explore various open source software’s internals and build powerful analyzers and
visualizers for real world applications built atop the open source software. If you are
interested, please send your resume to
firstname.lastname@example.org . Thank you!