lua https.request with certificate

Question

I'm trying to make a request on lua with certificate.

Recently I've gotten a COMODO SSL.

I've tried many tutorials on the internet, but to no avail.

I found this blog's proposal very interesting:

I am not getting able to execute the request on Linux/OpenWRT/Lua 5.1.

COMODO has provided me with the following files:

1. AddTrustExternalCARoot.crt
2. my_domain_com.crt
3. COMODORSAAddTrustCA.crt
4. COMODORSADomainValidationSecureServerCA.crt

And in this blog he mentions these files:

1. key = "/root/client.key"
2. certificate="/root/client.crt",
3. cafile="/root/ca.crt"

How do I convert the COMODO's .crt files the to those mentioned in the blog?

Obs: I tried to download with curl and get, but it did not work.

Answer 1

I solve it with this code:

module("https", package.seeall) 

local socket = require "socket" 
local http = require "socket.http" 
local ssl = require "ssl" 
local ltn12 = require "ltn12" 

local try = socket.try 
local protect = socket.protect 

local DEFAULT_PROTOCOL = "sslv23" 
local DEFAULT_CAFILE = "/etc/ssl/certs/ca-certificates.crt" 
local DEFAULT_VERIFY = "peer" 
local DEFAULT_OPTIONS = "all" 
local DEFAULT_CIPHERS = "ADH-AES256-SHA:ADH-AES128-SHA:HIGH:MEDIUM" 
local DEFAULT_HTTPS_PORT = 443 

local https_mt = { 
    -- Create proxy functions for each call through the metatable 
    __index = function(tbl, key) 
        local f = function(prxy, ...) 
            local c = prxy.c 
            return c[key](c, ...) 
        end 
        tbl[key] = f    -- Save new proxy function in cache for speed 
        return f 
    end 
} 

local function new_create(params) 
    return function() 
        local t = { c = try(socket.tcp()) } 
        function t:connect(host, port) 
            try(self.c:connect(host, port)) 
            self.c = try(ssl.wrap(self.c, params)) 
            try(self.c:dohandshake()) 
            return 1 
        end 
        return setmetatable(t, https_mt) 
    end 
end 

local function request_generic(args) 
    local sslparams = { 
        mode = "client", 
        protocol = args.protocol or DEFAULT_PROTOCOL, 
        cafile = args.cafile or DEFAULT_CAFILE, 
        verify = args.verify or DEFAULT_VERIFY, 
        options = args.options or DEFAULT_OPTIONS, 
        ciphers = args.ciphers or DEFAULT_CIPHERS 
    } 
    local req = { 
      url = args.url, 
      port = args.port or DEFAULT_HTTPS_PORT, 
      sink = args.sink, 
      method = args.method, 
      headers = args.headers, 
      source = args.source, 
      step = args.step, 
      proxy = args.proxy,       -- Buggy? 
      redirect = args.redirect, 
      create = new_create(sslparams) 
    } 
    return http.request(req) 
end 

local function request_simple(url, body) 
    local tbl = { } 
    local req = { 
        url = url, 
        sink = ltn12.sink.table(tbl) 
    } 
    if body then 
        req.method = "POST" 
        req.source = ltn12.source.string(body) 
        req.headers = { 
            ["Content-length"] = #body, 
            ["Content-type"] = "application/x-www-form-urlencoded" 
        } 
    end 
    local _, status, headers = request_generic(req) 
    return table.concat(tbl), status, headers 
end 


function request(req_or_url, body) 
    if type(req_or_url) == "string" then 
        return request_simple(req_or_url, body) 
    else 
        return request_generic(req_or_url) 
    end 
end 

Answer 2

I've described the details in a blog post; basically, you need to specify the mode and the certificate file for the ssl.wrap call:

local params = {
  mode = "client",
  protocol = "tlsv1",
  cafile = "/path/to/downloaded/cacert.pem", --<-- added cafile parameters
  verify = "peer", --<-- changed "none" to "peer"
  options = "all",
}

If you need to convert .crt to .pem file, then the following SO answer may help. I haven't tried with .crt, but the examples I have work with .pem files.