Fail to generate cert when request handled as file

[kiuka]

Hello,

I think I found a bug, that related to the size of the requests.

So far, I was using the default settings of client_body_buffer_size what is 16k, but it seems for some reason (it was working fine before) the requests exceed this limit now, so nginx created temp files from the requests:

2018/03/30 20:24:27 [warn] 8047#0: *144 a client request body is buffered to a temporary file /usr/local/openresty/nginx/client_body_temp/0000000001, client: 127.0.0.1, server: , request: "POST /deploy-cert HTTP/1.1", host: "127.0.0.1:89
99"

The problem is that it seems the hook doesnt handle this well, hence it fails:

2018/03/30 20:24:27 [error] 8047#0: *144 [lua] hook.lua:15: server(): auto-ssl: failed to parse POST args: request body in temp file not supported, client: 127.0.0.1, server: , request: "POST /deploy-cert HTTP/1.1", host: "127.0.0.1:8999
"
2018/03/30 20:24:27 [error] 8047#0: *104 [lua] lets_encrypt.lua:41: issue_cert(): auto-ssl: dehydrated failed: env HOOK_SECRET=9102785772569c4cc680938180ec41685dc9882d9cdc6d540c12792b09c5f47e HOOK_SERVER_PORT=8999 /usr/local/bin/resty-au
to-ssl/dehydrated --cron --accept-terms --no-lock --domain mydomain.com --challenge http-01 --config /etc/resty-auto-ssl/letsencrypt/config --hook /usr/local/bin/resty-auto-ssl/letsencrypt_hooks status: 256 out: # INFO: Using main config f
ile /etc/resty-auto-ssl/letsencrypt/config
+ Generating account key...
+ Registering account key with ACME server...
Processing mydomain.com
 + Signing domains...
 + Creating new directory /etc/resty-auto-ssl/letsencrypt/certs/mydomain.com ...
 + Creating chain cache directory /etc/resty-auto-ssl/letsencrypt/chains
 + Generating private key...
 + Generating signing request...
 + Requesting authorization for mydomain.com...
 + 1 pending challenge(s)
 + Deploying challenge tokens...
 + Responding to challenge for mydomain.com authorization...
 + Challenge is valid!
 + Requesting certificate...
 + Checking certificate...
 + Done!
 + Creating fullchain.pem...
 + Walking chain...
 err: curl: (22) The requested URL returned error: 500 Internal Server Error
hook request (deploy_cert) failed
, context: ssl_certificate_by_lua*, client: xx.xx.xx.xx, server: xx.xx.xx.xx:443
2018/03/30 20:24:27 [error] 8047#0: *104 [lua] ssl_certificate.lua:97: issue_cert(): auto-ssl: issuing new certificate failed: dehydrated failure, context: ssl_certificate_by_lua*, client: xx.xx.xx.xx, server: xx.xx.xx.xx:443
2018/03/30 20:24:27 [error] 8047#0: *104 [lua] ssl_certificate.lua:286: auto-ssl: could not get certificate for mydomain.com - using fallback - failed to get or issue certificate, context: ssl_certificate_by_lua*, client: xx.xx.xx.xx, server: xx.xx.xx.xx:443
2018/03/30 20:24:27 [info] 8047#0: *103 client closed connection while waiting for request, client: xx.xx.xx.xx, server: xx.xx.xx.xx:443

I increased the client_body_buffer_size to 8M and since that it works as it worked before:)

I havent found any other issue on this, but even if its not a bug, it can help to people who face the same issue.

[pdr]

I noticed the same issue starting yesterday. I'm not sure what triggered it (maybe OpenResty upgrade?) but the fix was the same as yours.

client_body_buffer_size 10M;

[kiuka]

I only updated after the problem came, so I changed nothing before. I havent checked, but maybe the key length of the cert changed or something like this significant that could indicate this problem

[GUI]

Yes, the client_body_buffer_size setting does need to be bigger than the default. The Let's Encrypt response size seems to hover around the default nginx size limits, so if you're just now seeing this, there may have been some subtle change that pushed it over the limit (or you may have just been lucky before).

More details in #77 and #65. As noted there, setting client_body_buffer_size to 128k should be more than sufficient (but setting it to much larger values also should be fine).

We've tried to call this setting out in the README's example configuration and in the v0.11 release notes, so I'm going to go ahead and close this issue. However, if you can think of any other suggestions to make this more obvious in the documentation, please let me know. Thanks!