Would love to read more articles like this, Thank you fro writing Sandeep. Sandeep Panda

How do I check if a cert was indeed generated for an arbitrary domain? I followed this guide but it doesn't seem to be working. Also, what are the last two server blocks for? (the one with auto_ssl:challenge_server() and the one with auto_ssl:hook_server()? Are they necessary for the auto ssl certs to be generated?

Thanks for such useful article.

I would appreciate if you'd look into some issues i have regarding this... stackoverflow.com/questions/61349531/configuratio…

Hi, very useful. I am looking for some alternatives I could use with Kubernetes in an automated way, but haven't had much success so far. Perhaps I could have the app create an ingress whenever a user adds a custom domain, and let cert-manager handle the certificate for me, but I am not sure yet if this is the best approach with Kubernetes. Anyway, what I wanted to ask you is if you have run into any limits not just with LetsEncrypt, but with the OpenResty solution. How many certificates can be handled with the Lua thing and by OpenResty/Nginx itself? Would this scale to thousands or 100s of thousands users if the app is successful? If scalability is not a huge issue with this solution I might try to adapt it to Kubernetes by using SSL passthrough from ingress controller to a customised instance of OpenResty. Thanks in advance!

How do you guys force a redirect to https for an arbitrary domain? Am stuck in it Facing too many redirects

  server {
    listen 443 ssl;
    ssl_certificate_by_lua_block {
      auto_ssl:ssl_certificate()
    }

  location / {

        proxy_pass http://localhost:4444;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
        proxy_redirect off;
        #try_files $uri $uri/ /;        
    }
         location @rewrites {
         rewrite ^(.+)$ / last;
  }
    ssl_certificate /etc/letsencrypt/live/mydomain/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mydomain/privkey.pem;
  }
  server {
    listen 80;
    location /.well-known/acme-challenge/ {
      content_by_lua_block {
        auto_ssl:challenge_server()
      }
    }
      location / {
         return 301 https://$host$request_uri; 
   }    
}

If you're running in Kubernetes (or at some point decide to move this), Bitnami recently released a runtime that automates this by using NGINX's Ingress Controller, External-DNS and Cert-Manager.

Dude, this is not merely a wonderful story of ingenuity, but a master class in how-to-investigate-and-optimize-design-for-all-stakeholders. Huzzah, HUZZAH, HUZZAH (three cheers)!

We are also using the same lua-resty-auto-ssl it works great:). By the way, there are few rate limits imposed by letsencrypt like you can create 50 certificates per week. Here you can check it out letsencrypt.org/docs/rate-limits Just curious How you gonna tackle this thing?