Async private key generation

Author: zyla

lib/resty/acme/autossl.lua

@@ -205,12 +205,16 @@ local function update_cert_handler(data)
   if not pkey then
     local t = ngx.now()
     if typ == 'rsa' then
-      pkey = util.create_pkey(4096, 'RSA')
+      local pkey, err = util.create_pkey(4096, 'RSA')
     elseif typ == 'ecc' then
-      pkey = util.create_pkey(nil, 'EC', 'prime256v1')
+      local pkey, err = util.create_pkey(nil, 'EC', 'prime256v1')
     else
       return "unknown key type: " .. typ
     end
+    if not pkey then
+      log(ngx_ERR, "error creating new ", typ, " private key for ", domain, ": ", err)
+      return err
+    end
     ngx.update_time()
     log(ngx_INFO, ngx.now() - t,  "s spent in creating new ", typ, " private key")
   end
@@ -456,7 +460,11 @@ function AUTOSSL.init(autossl_config, acme_config)
   else
     -- We always generate a key here incase there isn't already one in storage
     -- that way a consistent one can be shared across all workers
-    AUTOSSL.generated_account_key = AUTOSSL.create_account_key()
+    local key, err = AUTOSSL.create_account_key()
+    if not key then
+      error("failed to create account key: " .. err)
+    end
+    AUTOSSL.generated_account_key = key
   end
 
   if autossl_config.staging then
@@ -676,10 +684,10 @@ end
 
 function AUTOSSL.create_account_key()
   local t = ngx.now()
-  local pkey = util.create_pkey(4096, 'RSA')
+  local pkey, err = util.create_pkey(4096, 'RSA')
   ngx.update_time()
   log(ngx_INFO, ngx.now() - t,  "s spent in creating new account key")
-  return pkey
+  return pkey, err
 end
 
 function AUTOSSL.load_account_key_storage()

lib/resty/acme/util.lua

@@ -90,6 +90,15 @@ local function create_csr(domain_pkey, ...)
 end
 
 local function create_pkey(bits, typ, curve)
+  local ok, result_or_err = ngx.run_worker_thread('create_pkey', 'resty.acme.util', 'create_pkey_sync', bits, type)
+  if not ok then
+    ngx_log(ngx_ERR, "create_pkey: failed to run worker thread: ", result_or_err)
+    return nil, result_or_err
+  end
+  return result_or_err
+end
+
+local function create_pkey_sync(bits, typ, curve)
   bits = bits or 4096
   typ = typ or 'RSA'
   local pkey = openssl.pkey.new({
@@ -179,6 +188,7 @@ return {
     thumbprint = thumbprint,
     create_csr = create_csr,
     create_pkey = create_pkey,
+    create_pkey_sync = create_pkey_sync,
     check_chain_root_issuer = check_chain_root_issuer,
     log = log,
 }