# Openresty + socket + ssl question **URL:** \ **Category:** NGINX\ **Created:** [March 5, 2012, 4:30pm UTC](https://www.ruby-forum.com/t/openresty-socket-ssl-question/217570 "2012-03-05T16:30:38Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\ **Post date:** [March 5, 2012, 4:30pm UTC](https://www.ruby-forum.com/t/openresty-socket-ssl-question/217570/1 "2012-03-05T16:30:38Z")
Hello! This question is for agentzh, one of OpenResty authors. i need some help or proper direction to look futher, please help… I`m using openresty 1.0.11.19 (nginx+lua, great mix btw) and wish to make calls to ssl-enabled third-party server (Apple Push Notifications server, specifically). For this i hoped to use recently added to openresty “ngx.socket.\*” functionality with LuaSec module to enable ssl-protected communication. But seems it is not possible because LuaSec requires setfd/getfd methods (raw access to socket file descriptors) just as LuaSocket. Seems there is no other lua library that can do ssl exchange only with simple “send/receive” over already established connection anyway ☹ am i right? before that i tryed to use nginx build-in “upstream + proxy\_pass https://” functionality, but in that case there is no way to specify custom key+cert for upstream call and there is no way to specify proper payload (apple APN servers are requiring direct message exchange over sll-protected connection) Thanks in advance for any help sincerely, Ilja R. ---
**Author:** ![Ilja\_R](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/e56c9b/32.png) [@Ilja\_R](https://www.ruby-forum.com/u/Ilja_R)\ **Post date:** [March 6, 2012, 5:32am UTC](https://www.ruby-forum.com/t/openresty-socket-ssl-question/217570/2 "2012-03-06T05:32:55Z")
On Mon, Mar 5, 2012 at 11:29 PM, Ilja R. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > i need some help or proper direction to look futher, please help… > I`m using openresty 1.0.11.19 (nginx+lua, great mix btw) and wish to > make calls to ssl-enabled third-party server (Apple Push Notifications > server, specifically). The SSL handshake support for ngx\_lua cosocket is still a TODO 🙂 I’ll expose the underlying SSL handshake API provided by the Nginx core to the Lua land. You’re very welcome to provide a patch for ngx\_lua though 🙂 > For this i hoped to use recently added to openresty “ngx.socket.\*” > functionality with LuaSec module to enable ssl-protected > communication. But seems it is not possible because LuaSec requires > setfd/getfd methods (raw access to socket file descriptors) just as > LuaSocket. Seems there is no other lua library that can do ssl > exchange only with simple “send/receive” over already established > connection anyway ☹ am i right? You must not use the LuaSec library in ngx\_lua even if the cosocket provides the setfd/getfd methods. That’s because it uses “poll” internally to do the network I/O, which will tragically block the Nginx main event loop (and thus the whole nginx worker process) and ruin Nginx’s performance. > before that i tryed to use nginx build-in “upstream + proxy\_pass > https://” functionality, but in that case there is no way to specify > custom key+cert for upstream call and there is no way to specify > proper payload (apple APN servers are requiring direct message > exchange over sll-protected connection) Fair enough 🙂 Best, -agentzh ---
**Author:** ![Ilja\_R](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/e56c9b/32.png) [@Ilja\_R](https://www.ruby-forum.com/u/Ilja_R)\ **Post date:** [March 6, 2012, 1:42pm UTC](https://www.ruby-forum.com/t/openresty-socket-ssl-question/217570/3 "2012-03-06T13:42:17Z")
I see, so there is no way to do this purely via ngx\_lua, for now? ☹ I`ll try to use standalone server to send APNs first, this is just faster way to start testing our application. But i will be glad to test out ssl support in OpenResty when it will be available 🙂 Thanks for great product! On Tue, Mar 6, 2012 at 8:32 AM, agentzh [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > You’re very welcome to provide a patch for ngx\_lua though 🙂 > You must not use the LuaSec library in ngx\_lua even if the cosocket > > > > > Fair enough 🙂 > > Best, > -agentzh > > * * * > > nginx mailing list > [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > [mailman.nginx.org archive](http://mailman.nginx.org/mailman/listinfo/nginx) – с уважением, Разинков Илья