Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

api: add SSL support #35

Closed
vmakhaev opened this issue Aug 6, 2016 · 8 comments · Fixed by #200
Closed

api: add SSL support #35

vmakhaev opened this issue Aug 6, 2016 · 8 comments · Fixed by #200
Assignees
@themilchenko
Labels
3sp good first issue Good for newcomers teamE
Milestone
wishlist

Comments

@vmakhaev
Copy link
Contributor

vmakhaev commented Aug 6, 2016

One of possible use cases: AWS Lambda functions does not support non SSL endpoints: https://forums.aws.amazon.com/message.jspa?messageID=665904
@cbalano
Copy link

cbalano commented Feb 3, 2018

Any news on a http server with SSL support please?

@knazarov
Copy link
Contributor

knazarov commented Feb 3, 2018

Implementing SSL support with openssl is definitely possible, though it's not trivial to do, and will likely not happen in the nearest future, unless there is a contributor that is willing to work on it.

The primary reason it's not high on the list of priorities is that there are lots of mature SSL reverse-proxies. For example, nginx.

@kostja
Copy link
Contributor

kostja commented Feb 3, 2018

Please also note that we do have ssl support in http.client already.

@cbalano
Copy link

cbalano commented Feb 4, 2018

Alright, thank you; I finally saw the light. The TNT http connection will be unencrypted in the local docker network. For servicing the routes outside the local network, I will configure an NGINX container to act as an edge server.

@cbalano
Copy link

cbalano commented Feb 4, 2018

Please also note that we do have ssl support in http.client already.

The http.client is not interesting because it's blocking. Using a high speed db like Tarantool only to wait on the completion of your http requests is not a compelling scenario.

@knazarov
Copy link
Contributor

knazarov commented Feb 5, 2018

@cbalano yes, that's how I do it. My rule of thumb is to always start with the plain http server (tarantool/http) and add SSL on top with nginx. In case if you'd need pipelining or some obscure http features that the Lua module doesn't handle, you can transition to the tarantool-nginx module later https://github.com/tarantool/nginx_upstream_module .

@kostja kostja added the good first issue Good for newcomers label Feb 10, 2018
@rohitjoshi
Copy link

that would not work where encryption on transit is required including a local loopback/unix domain server. So it would be good to have support for an optional SSL.

@Totktonada Totktonada added this to the wishlist milestone Feb 3, 2022
@oleg-jukovec oleg-jukovec changed the title SSL support api: add SSL support Nov 4, 2024
@oleg-jukovec
Copy link
Contributor

oleg-jukovec commented Nov 4, 2024 •
edited
Loading

It was decided to support SSL for Tarantool EE (at least) via a copy-pasted sslsocket.lua.

We need to add support for ssl_password and ssl_password_file here too.

The new function should be updated to include all available TLS options:

https://github.com/tarantool/http?tab=readme-ov-file#creating-a-server

  • ssl_cert_file
  • ssl_key_file
  • ssl_ca_file
  • ssl_ciphers
  • ssl_password
  • ssl_password_file

@oleg-jukovec oleg-jukovec mentioned this issue Nov 4, 2024
Closed
@oleg-jukovec oleg-jukovec added 3sp and removed 2sp labels Nov 4, 2024
themilchenko added a commit that referenced this issue Nov 8, 2024
@themilchenko
api: add SSL support
596850c 
It wasn't SSL support. After the patch it was added there are several
options to configure SSL:

  * `use_tls` is a boolean param to enable tls with tls_options provied below (`false` by default);
  * `ssl_cert_file` is a path to the SSL cert file;
  * `ssl_key_file` is a path to the SSL key file;
  * `ssl_ca_file` is a path to the SSL CA file;
  * `ssl_ciphers` is a colon-separated list of SSL ciphers;
  * `ssl_password` is a password for decrypting SSL private key;
  * `ssl_password_file` is a SSL file with key for decrypting SSL private key.

Closes #35
@themilchenko themilchenko mentioned this issue Nov 8, 2024
Merged
themilchenko added a commit that referenced this issue Nov 8, 2024
@themilchenko
api: add SSL support
126c428 
It wasn't SSL support. After the patch it was added there are several
options to configure SSL:

  * `use_tls` is a boolean param to enable tls with tls_options provied below (`false` by default);
  * `ssl_cert_file` is a path to the SSL cert file;
  * `ssl_key_file` is a path to the SSL key file;
  * `ssl_ca_file` is a path to the SSL CA file;
  * `ssl_ciphers` is a colon-separated list of SSL ciphers;
  * `ssl_password` is a password for decrypting SSL private key;
  * `ssl_password_file` is a SSL file with key for decrypting SSL private key.

Closes #35
themilchenko added a commit that referenced this issue Nov 8, 2024
@themilchenko
api: add SSL support
5ba2bc8 
It wasn't SSL support. After the patch it was added there are several
options to configure SSL:

  * `use_tls` is a boolean param to enable tls with tls_options provied below (`false` by default);
  * `ssl_cert_file` is a path to the SSL cert file;
  * `ssl_key_file` is a path to the SSL key file;
  * `ssl_ca_file` is a path to the SSL CA file;
  * `ssl_ciphers` is a colon-separated list of SSL ciphers;
  * `ssl_password` is a password for decrypting SSL private key;
  * `ssl_password_file` is a SSL file with key for decrypting SSL private key.

Closes #35
themilchenko added a commit that referenced this issue Nov 8, 2024
@themilchenko
api: add SSL support
228143e 
It wasn't SSL support. After the patch it was added there are several
options to configure SSL:

  * `use_tls` is a boolean param to enable tls with tls_options provied below (`false` by default);
  * `ssl_cert_file` is a path to the SSL cert file;
  * `ssl_key_file` is a path to the SSL key file;
  * `ssl_ca_file` is a path to the SSL CA file;
  * `ssl_ciphers` is a colon-separated list of SSL ciphers;
  * `ssl_password` is a password for decrypting SSL private key;
  * `ssl_password_file` is a SSL file with key for decrypting SSL private key.

Closes #35
themilchenko added a commit that referenced this issue Nov 8, 2024
@themilchenko
api: add SSL support
078096f 
It wasn't SSL support. After the patch it was added there are several
options to configure SSL:

  * `use_tls` is a boolean param to enable tls with tls_options provied below (`false` by default);
  * `ssl_cert_file` is a path to the SSL cert file;
  * `ssl_key_file` is a path to the SSL key file;
  * `ssl_ca_file` is a path to the SSL CA file;
  * `ssl_ciphers` is a colon-separated list of SSL ciphers;
  * `ssl_password` is a password for decrypting SSL private key;
  * `ssl_password_file` is a SSL file with key for decrypting SSL private key.

Closes #35
themilchenko added a commit that referenced this issue Nov 8, 2024
@themilchenko
api: add SSL support
0b43ad5 
It wasn't SSL support. After the patch it was added there are several
options to configure SSL:

  * `use_tls` is a boolean param to enable tls with tls_options provied below (`false` by default);
  * `ssl_cert_file` is a path to the SSL cert file;
  * `ssl_key_file` is a path to the SSL key file;
  * `ssl_ca_file` is a path to the SSL CA file;
  * `ssl_ciphers` is a colon-separated list of SSL ciphers;
  * `ssl_password` is a password for decrypting SSL private key;
  * `ssl_password_file` is a SSL file with key for decrypting SSL private key.

Closes #35
themilchenko added a commit that referenced this issue Nov 8, 2024
@themilchenko
api: add SSL support
685400c 
It wasn't SSL support. After the patch it was added there are several
options to configure SSL:

  * `use_tls` is a boolean param to enable tls with tls_options provied below (`false` by default);
  * `ssl_cert_file` is a path to the SSL cert file;
  * `ssl_key_file` is a path to the SSL key file;
  * `ssl_ca_file` is a path to the SSL CA file;
  * `ssl_ciphers` is a colon-separated list of SSL ciphers;
  * `ssl_password` is a password for decrypting SSL private key;
  * `ssl_password_file` is a SSL file with key for decrypting SSL private key.

Closes #35
themilchenko added a commit that referenced this issue Nov 8, 2024
@themilchenko
api: add SSL support
33f259b 
It wasn't SSL support. After the patch it was added there are several
options to configure SSL:

  * `use_tls` is a boolean param to enable tls with tls_options provied below (`false` by default);
  * `ssl_cert_file` is a path to the SSL cert file;
  * `ssl_key_file` is a path to the SSL key file;
  * `ssl_ca_file` is a path to the SSL CA file;
  * `ssl_ciphers` is a colon-separated list of SSL ciphers;
  * `ssl_password` is a password for decrypting SSL private key;
  * `ssl_password_file` is a SSL file with key for decrypting SSL private key.

Closes #35
themilchenko added a commit that referenced this issue Nov 8, 2024
@themilchenko
api: add SSL support
99cd93c 
It wasn't SSL support. After the patch it was added there are several
options to configure SSL:

  * `use_tls` is a boolean param to enable tls with tls_options provied below (`false` by default);
  * `ssl_cert_file` is a path to the SSL cert file;
  * `ssl_key_file` is a path to the SSL key file;
  * `ssl_ca_file` is a path to the SSL CA file;
  * `ssl_ciphers` is a colon-separated list of SSL ciphers;
  * `ssl_password` is a password for decrypting SSL private key;
  * `ssl_password_file` is a SSL file with key for decrypting SSL private key.

Closes #35
themilchenko added a commit that referenced this issue Nov 11, 2024
@themilchenko
api: add SSL support
44a1a2e 
It wasn't SSL support. After the patch it was added several options to
configure SSL, use one of them to enable it:

  * `ssl_cert_file` is a path to the SSL cert file;
  * `ssl_key_file` is a path to the SSL key file;
  * `ssl_ca_file` is a path to the SSL CA file;
  * `ssl_ciphers` is a colon-separated list of SSL ciphers;
  * `ssl_password` is a password for decrypting SSL private key;
  * `ssl_password_file` is a SSL file with key for decrypting SSL private key.

Closes #35
themilchenko added a commit that referenced this issue Nov 11, 2024
@themilchenko
api: add SSL support
0d0d90b 
It wasn't SSL support. After the patch it was added several options to
configure SSL, use one of them to enable it:

  * `ssl_cert_file` is a path to the SSL cert file;
  * `ssl_key_file` is a path to the SSL key file;
  * `ssl_ca_file` is a path to the SSL CA file;
  * `ssl_ciphers` is a colon-separated list of SSL ciphers;
  * `ssl_password` is a password for decrypting SSL private key;
  * `ssl_password_file` is a SSL file with key for decrypting SSL private key.

Closes #35
themilchenko added a commit that referenced this issue Nov 11, 2024
@themilchenko
api: add SSL support
354b6b6 
It wasn't SSL support. After the patch it was added several options to
configure SSL, use one of them to enable it:

  * `ssl_cert_file` is a path to the SSL cert file;
  * `ssl_key_file` is a path to the SSL key file;
  * `ssl_ca_file` is a path to the SSL CA file;
  * `ssl_ciphers` is a colon-separated list of SSL ciphers;
  * `ssl_password` is a password for decrypting SSL private key;
  * `ssl_password_file` is a SSL file with key for decrypting SSL private key.

Closes #35
themilchenko added a commit that referenced this issue Nov 11, 2024
@themilchenko
api: add SSL support
3df4f51 
It wasn't SSL support. After the patch it was added several options to
configure SSL, use one of them to enable it:

  * `ssl_cert_file` is a path to the SSL cert file;
  * `ssl_key_file` is a path to the SSL key file;
  * `ssl_ca_file` is a path to the SSL CA file;
  * `ssl_ciphers` is a colon-separated list of SSL ciphers;
  * `ssl_password` is a password for decrypting SSL private key;
  * `ssl_password_file` is a SSL file with key for decrypting SSL private key.

Closes #35
themilchenko added a commit that referenced this issue Nov 11, 2024
@themilchenko
api: add SSL support
dc753ad 
It wasn't SSL support. After the patch it was added several options to
configure SSL, use one of them to enable it:

  * `ssl_cert_file` is a path to the SSL cert file;
  * `ssl_key_file` is a path to the SSL key file;
  * `ssl_ca_file` is a path to the SSL CA file;
  * `ssl_ciphers` is a colon-separated list of SSL ciphers;
  * `ssl_password` is a password for decrypting SSL private key;
  * `ssl_password_file` is a SSL file with key for decrypting SSL private key.

Closes #35
themilchenko added a commit that referenced this issue Nov 11, 2024
@themilchenko
api: add SSL support
c4ed7e3 
It wasn't SSL support. After the patch it was added several options to
configure SSL, use one of them to enable it:

  * `ssl_cert_file` is a path to the SSL cert file;
  * `ssl_key_file` is a path to the SSL key file;
  * `ssl_ca_file` is a path to the SSL CA file;
  * `ssl_ciphers` is a colon-separated list of SSL ciphers;
  * `ssl_password` is a password for decrypting SSL private key;
  * `ssl_password_file` is a SSL file with key for decrypting SSL private key.

Closes #35
themilchenko added a commit that referenced this issue Nov 11, 2024
@themilchenko
api: add SSL support
72de6b4 
It wasn't SSL support. After the patch it was added several options to
configure SSL, use one of them to enable it:

  * `ssl_cert_file` is a path to the SSL cert file;
  * `ssl_key_file` is a path to the SSL key file;
  * `ssl_ca_file` is a path to the SSL CA file;
  * `ssl_ciphers` is a colon-separated list of SSL ciphers;
  * `ssl_password` is a password for decrypting SSL private key;
  * `ssl_password_file` is a SSL file with key for decrypting SSL private key.

Closes #35
themilchenko added a commit that referenced this issue Nov 11, 2024
@themilchenko
api: add SSL support
fe8357e 
It wasn't SSL support. After the patch it was added several options to
configure SSL, use one of them to enable it:

  * `ssl_cert_file` is a path to the SSL cert file;
  * `ssl_key_file` is a path to the SSL key file;
  * `ssl_ca_file` is a path to the SSL CA file;
  * `ssl_ciphers` is a colon-separated list of SSL ciphers;
  * `ssl_password` is a password for decrypting SSL private key;
  * `ssl_password_file` is a SSL file with key for decrypting SSL private key.

Closes #35
themilchenko added a commit that referenced this issue Nov 12, 2024
@themilchenko
api: add SSL support
a82f148 
It wasn't SSL support. After the patch it was added several options to
configure SSL, use one of them to enable it:

  * `ssl_cert_file` is a path to the SSL cert file;
  * `ssl_key_file` is a path to the SSL key file;
  * `ssl_ca_file` is a path to the SSL CA file;
  * `ssl_ciphers` is a colon-separated list of SSL ciphers;
  * `ssl_password` is a password for decrypting SSL private key;
  * `ssl_password_file` is a SSL file with key for decrypting SSL private key.

Closes #35
@themilchenko themilchenko mentioned this issue Nov 14, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@themilchenko themilchenko

Labels
3sp good first issue Good for newcomers teamE
Projects
None yet
Milestone
wishlist
Development

Successfully merging a pull request may close this issue.

api: add SSL support tarantool/http
8 participants
@Totktonada @kostja @vmakhaev @rohitjoshi @knazarov @oleg-jukovec @cbalano @themilchenko