lualib/ngx/ssl.lua:77: : worker process: undefined symbol: ngx_http_lua_ffi_ssl_clear_certs

hook1988 · 2016-12-03T23:33:51+00:00

Hi,On Thu, Dec 1, 2016 at 10:42 AM, Timothy Gallagher <golgoa...@gmail.com> wrote:Hello all, I am wondering if I can set proxy_pass from within a...

lualib/ngx/ssl.lua:77: : worker process: undefined symbol: ngx_http_lua_ffi_ssl_clear_certs

hook1988

Hello,

I want to use ssl_certificate_by_lua_file / ssl_certificate_by_lua_block in my nginx config, but whenever I am accessing the web page over https, it gives me an error:

2016/12/03 15:18:50 [error] 29302#29302: *2 lua entry thread aborted: runtime error: /home/webserver/nginx/lualib/ngx/ssl.lua:77: : worker process: undefined symbol: ngx_http_lua_ffi_ssl_clear_certs
stack traceback:
coroutine 0:
        [C]: in function '__index'
        /home/webserver/nginx/lualib/ngx/ssl.lua:77: in function 'clear_certs'
        ssl_certificate_by_lua:7: in function <ssl_certificate_by_lua:1>, context: ssl_certificate_by_lua*, client: 86.x.x.x, server: 0.0.0.0:443
2016/12/03 15:18:50 [crit] 29302#29302: *1 SSL_do_handshake() failed (SSL: error:1408A179:SSL routines:ssl3_get_client_hello:cert cb error) while SSL handshaking, client: 86.x.x.x, server: 0.0.0.0:443

nginx compile arguments:

nginx version: openresty/1.11.2.2
built by gcc 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.4) 
built with OpenSSL 1.0.2g  1 Mar 2016
TLS SNI support enabled
configure arguments: --prefix=/home/webserver/nginx/nginx --with-cc-opt='-O2 -I /usr/local/include -O2 -static -static-libgcc' --add-module=../ngx_devel_kit-0.3.0 --add-module=../echo-nginx-module-0.60 --add-module=../xss-nginx-module-0.05 --add-module=../ngx_coolkit-0.2rc3 --add-module=../set-misc-nginx-module-0.31 --add-module=../form-input-nginx-module-0.12 --add-module=../encrypted-session-nginx-module-0.06 --add-module=../srcache-nginx-module-0.31 --add-module=../ngx_lua-0.10.7 --add-module=../ngx_lua_upstream-0.06 --add-module=../headers-more-nginx-module-0.32 --add-module=../array-var-nginx-module-0.05 --add-module=../memc-nginx-module-0.17 --add-module=../redis2-nginx-module-0.13 --add-module=../redis-nginx-module-0.3.7 --add-module=../rds-json-nginx-module-0.14 --add-module=../rds-csv-nginx-module-0.07 --with-ld-opt='-Wl,-rpath,/home/webserver/nginx/luajit/lib -L /usr/local/lib -Bstatic -static -static-libgcc -static-libstdc++ -lcrypto -static -Bstatic' --add-module=/home/webserver-compile/openresty-1.11.2.2/modules/nginx-vod-module --with-http_v2_module --with-http_ssl_module --with-openssl=/home/webserver-compile/openresty-1.11.2.2/../openssl-1.0.2g --with-http_stub_status_module --conf-path=/home/webserver/nginx/nginx.conf --pid-path=/run/nginx.pid --error-log-path=/home/webserver/nginx/logs/error.log --http-log-path=/home/webserver/nginx/logs/access.log --user=www-data --group=www-data --with-ipv6 --with-file-aio --with-threads

nginx config:

server {
    listen [::]:80 default_server;
    listen 80;

    listen [::]:443 ssl;
    listen 443 ssl;

    server_name *.example.com;

    root  /home/webserver/html/;
    index index.php index.html index.htm;

    server_tokens off;
    #resolver 8.8.8.8 [2001:4860:4860::8888] ;
    resolver 8.8.8.8 8.8.4.4;

    # useless placeholders: just to shut up NGINX configuration loader errors
    ssl_certificate    /home/webserver/certs/example.com.2016.pem;
    ssl_certificate_key    /home/webserver/certs/example.com.2016.key;

    #ssl_certificate_by_lua_file /home/webserver/nginx/lua/ssl_cert.lua;

    ssl_certificate_by_lua_block {
        local ssl = require "ngx.ssl"

        -- clear the fallback certificates and private keys
        -- set by the ssl_certificate and ssl_certificate_key
        -- directives above:
        local ok, err = ssl.clear_certs()
        if not ok then
            ngx.log(ngx.ERR, "failed to clear existing (fallback) certificates")
            return ngx.exit(ngx.ERROR)
        end
        local pem_path = "/home/webserver/certs/example.com.2016.pem"
        local key_path = "/home/webserver/certs/example.com.2016.key"

        local f=io.open(pem_path,"r")
        if f~=nil then
            local pem_cert_chain = f:read("*all")
            ngx.log(ngx.WARN, "pem_cert_chain: " .. pem_cert_chain)
            f:close()
        else
            ngx.log(ngx.ERR, "ssl certificate not found: " .. pem_path)
            return ngx.exit(ngx.ERR)
        end

        local der_cert_chain, err = ssl.cert_pem_to_der(pem_cert_chain)
        if not der_cert_chain then
            ngx.log(ngx.ERR, "failed to convert certificate chain ",
                    "from PEM to DER: ", err)
            return ngx.exit(ngx.ERROR)
        end

        local ok, err = ssl.set_der_cert(der_cert_chain)
        if not ok then
            ngx.log(ngx.ERR, "failed to set DER cert: ", err)
            return ngx.exit(ngx.ERROR)
        end

        -- private key file
        local f=io.open(key_path,"r")
        if f~=nil then
            local cert_key = f:read("*all")
            f:close()
        else
            ngx.log(ngx.ERR, "ssl key file not found: " .. key_path)
            return ngx.exit(ngx.ERR)
        end
        -- assuming the user already defines the my_load_private_key()
        -- function herself.
        local der_pkey = cert_key

        local ok, err = ssl.set_der_priv_key(der_pkey)
        if not ok then
            ngx.log(ngx.ERR, "failed to set DER private key: ", err)
            return ngx.exit(ngx.ERROR)
        end
    }

    ssl_session_cache shared:SSL:10m;
    #enables all versions of TLS, but not SSLv2 or 3 which are weak and now deprecated.
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    #Disables all weak ciphers
    ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
    #ssl_ciphers EECDH+AESGCM:EDH+AESGCM:EECDH:EDH:!MD5:!RC4:!LOW:!MEDIUM:!CAMELLIA:!ECDSA:!DES:!DSS:!3DES:!NULL;
    ssl_prefer_server_ciphers on;
    include /home/webserver/nginx/webserver-data.conf;
}

OS is Ubuntu 16.04, kernel 4.4.0-31-generic

I already tried compiling with OpenSSL 1.0.2.j without success.

Is there anything I am doing wrong?

jonathan

did openresty compile correctly? i think the included openssl patch is against 1.02h

anyways, we use ubuntu 16.04

the following are my build instructions... nginx is installed/removed to get the library dependencies and system scripts installed. then i remove it.

i install openssl into a versioned path to ensure it installs, but compile openresty against the source

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

apt-get install nginx

apt-get remove nginx

apt-get remove nginx-core

apt-get remove nginx-common

cd ~

mkdir build

cd ~/build

apt-get install libreadline-dev libncurses5-dev libpcre3-dev libssl-dev perl make build-essential

wget https://www.openssl.org/source/openssl-1.0.2j.tar.gz

tar -xzvf openssl-1.0.2j.tar.gz

cd openssl-1.0.2j

./config --prefix=/usr/local/openssl/openssl-1.02j --openssldir=/usr/local/openssl/openssl-1.02j

make depend

make && make test

sudo make install

cd ~/build

wget https://openresty.org/download/openresty-1.11.2.2.tar.gz

tar xzvf openresty-1.11.2.2.tar.gz

cd openresty-1.11.2.2

./configure \

--with-sha1=/opt/openssl/include/openssl \

--with-md5=/opt/openssl/include/openssl \

--conf-path=/etc/nginx/nginx.conf \

--error-log-path=/var/log/nginx/error.log \

--http-log-path=/var/log/nginx/access.log \

--lock-path=/var/lock/nginx.lock \

--pid-path=/var/run/nginx.pid \

--with-openssl=../openssl-1.0.2j \

-j4

make -j4

sudo make install

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

hook1988

I'm sorry, it seems I compiled with ubuntu 16.04 and executed the binary on an ubuntu 14.04. I have different test systems where it needs to run.
So we can consider it as resolved, because it's running fine on ubuntu 16.04.
I just need a method now to get it running on ubuntu 14.04 ...
(nginx: [emerg] at least OpenSSL 1.0.2e required but found OpenSSL 1.0.1f 6 Jan 2014)

Thanks anyway for your help.

did openresty compile correctly? i think the included openssl patch is against 1.02h

anyways, we use ubuntu 16.04

the following are my build instructions... nginx is installed/removed to get the library dependencies and system scripts installed. then i remove it.

i install openssl into a versioned path to ensure it installs, but compile openresty against the source

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
apt-get install nginx
apt-get remove nginx
apt-get remove nginx-core
apt-get remove nginx-common

cd ~
mkdir build

cd ~/build
apt-get install libreadline-dev libncurses5-dev libpcre3-dev libssl-dev perl make build-essential
wget https://www.openssl.org/source/openssl-1.0.2j.tar.gz
tar -xzvf openssl-1.0.2j.tar.gz
cd openssl-1.0.2j
./config --prefix=/usr/local/openssl/openssl-1.02j --openssldir=/usr/local/openssl/openssl-1.02j
make depend
make && make test
sudo make install

cd ~/build
wget https://openresty.org/download/openresty-1.11.2.2.tar.gz
tar xzvf openresty-1.11.2.2.tar.gz
cd openresty-1.11.2.2
./configure \
--with-sha1=/opt/openssl/include/openssl \
--with-md5=/opt/openssl/include/openssl \
--conf-path=/etc/nginx/nginx.conf \
--error-log-path=/var/log/nginx/error.log \
--http-log-path=/var/log/nginx/access.log \
--lock-path=/var/lock/nginx.lock \
--pid-path=/var/run/nginx.pid \
--with-openssl=../openssl-1.0.2j \
-j4
make -j4
sudo make install
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

rpaprocki

Hi,

Nginx (and thus openresty) provides a configure flag --with-openssl=/path/to/ssl that allows you to define a path to a local OpenSSL source directory. You can use this to compile openresty with a static, modern version of OpenSSL.

Sent from my iPhone

On Dec 3, 2016, at 11:29, Mi Ho <hoo...@gmail.com> wrote:

I'm sorry, it seems I compiled with ubuntu 16.04 and executed the binary on an ubuntu 14.04. I have different test systems where it needs to run.
So we can consider it as resolved, because it's running fine on ubuntu 16.04.
I just need a method now to get it running on ubuntu 14.04 ...
(nginx: [emerg] at least OpenSSL 1.0.2e required but found OpenSSL 1.0.1f 6 Jan 2014)

Thanks anyway for your help.

did openresty compile correctly? i think the included openssl patch is against 1.02h

anyways, we use ubuntu 16.04

the following are my build instructions... nginx is installed/removed to get the library dependencies and system scripts installed. then i remove it.

i install openssl into a versioned path to ensure it installs, but compile openresty against the source

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
apt-get install nginx
apt-get remove nginx
apt-get remove nginx-core
apt-get remove nginx-common

cd ~
mkdir build

cd ~/build
apt-get install libreadline-dev libncurses5-dev libpcre3-dev libssl-dev perl make build-essential
wget https://www.openssl.org/source/openssl-1.0.2j.tar.gz
tar -xzvf openssl-1.0.2j.tar.gz
cd openssl-1.0.2j
./config --prefix=/usr/local/openssl/openssl-1.02j --openssldir=/usr/local/openssl/openssl-1.02j
make depend
make && make test
sudo make install

cd ~/build
wget https://openresty.org/download/openresty-1.11.2.2.tar.gz
tar xzvf openresty-1.11.2.2.tar.gz
cd openresty-1.11.2.2
./configure \
--with-sha1=/opt/openssl/include/openssl \
--with-md5=/opt/openssl/include/openssl \
--conf-path=/etc/nginx/nginx.conf \
--error-log-path=/var/log/nginx/error.log \
--http-log-path=/var/log/nginx/access.log \
--lock-path=/var/lock/nginx.lock \
--pid-path=/var/run/nginx.pid \
--with-openssl=../openssl-1.0.2j \
-j4
make -j4
sudo make install
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

.