Dynamically binds a specific SSL certificate to the request_host value of a service. In case you want to setup a global SSL certificate for every API, take a look at the [Kong SSL configuration options][configuration].

Note: As of Kong 0.10.0, this plugin has been removed and the core is now directly responsible for dynamically serving SSL certificates. You can read about how to serve an API over SSL in the Proxy and the Admin API references.

Terminology

  • plugin: a plugin executing actions inside Kong before or after a request has been proxied to the upstream API.
  • API: (deprecated) the Kong entity representing your upstream service placed behind Kong, for which Kong proxies requests to.
  • Service: the Kong entity representing an external upstream API or microservice.
  • Route: the Kong entity representing a way to map downstream requests to upstream services.
  • Consumer: the Kong entity representing a developer or machine using the API. When using Kong, a Consumer only communicates with Kong which proxies every call to the said upstream API.
  • Credential: a unique string associated with a Consumer, also referred to as an API key.
  • upstream service: this refers to your own API/service sitting behind Kong, to which client requests are forwarded.

Configuration

Enabling the plugin for a Service

Configure on top of a Service by executing the following request on your Kong server:

$ curl -X POST http://kong:8001/services/{service}/plugins \
    --data "name=ssl"  \
    --data "[email protected]/path/to/cert.pem" \
    --data "[email protected]/path/to/cert.key" \
    --data "config.only_https=true"
  • service: the id or name of the Service that this plugin configuration will target.

Enabling the plugin for a Route

Configure on top of a Route with:

$ curl -X POST http://kong:8001/routes/{route_id}/plugins \
    --data "name=ssl"  \
    --data "[email protected]/path/to/cert.pem" \
    --data "[email protected]/path/to/cert.key" \
    --data "config.only_https=true"
  • route_id: the id of the Route that this plugin configuration will target.

Enabling the plugin for an API

If you are using the deprecated API entity, you can configure on top of an API by executing the following request on your Kong server:

$ curl -X POST http://kong:8001/apis/{api}/plugins \
    --data "name=ssl"  \
    --data "[email protected]/path/to/cert.pem" \
    --data "[email protected]/path/to/cert.key" \
    --data "config.only_https=true"
  • api: either id or name of the API that this plugin configuration will target.

Enabling the plugin for a Consumer

You can use the http://localhost:8001/plugins endpoint to target Consumers:

$ curl -X POST http://kong:8001/plugins \
    --data "name=ssl" \
    --data "consumer_id={consumer_id}"  \
    --data "[email protected]/path/to/cert.pem" \
    --data "[email protected]/path/to/cert.key" \
    --data "config.only_https=true"

Where consumer_id: The id of the Consumer we want to associate with this plugin.

You can combine adding consumer_id and service_id in the same request.

Once applied, any user with a valid credential can access the Service/API. To restrict usage to only some of the authenticated users, also add the ACL plugin (not covered here) and create whitelist or blacklist groups of users.

Global plugins

All plugins can be configured using the http:/kong:8001/plugins/ endpoint. A plugin which is not associated to any API, Service, Route or Consumer is considered "global", and will be run on every request. Read the Plugin Reference and the Plugin Precedence sections for more information.

Parameters

Here's a list of all the parameters which can be used in this plugin's configuration:

form parameterdefaultdescription
nameThe name of the plugin to use, in this case ssl
api_idThe id of the API which this plugin will target.
service_idThe id of the Service which this plugin will target.
route_idThe id of the Route which this plugin will target.
consumer_idThe id of the Consumer which this plugin will target.
config.cert

Upload the data of the certificate to use. Note that is the the actual data of the key (not the path), so it should be sent in multipart/form-data upload request.

config.key

Upload the data of the certificate key to use. Note that is the the actual data of the key (not the path), so it should be sent in multipart/form-data upload request.

config.only_https
optional

false

Specify if the service should only be available through an https protocol.

config.accept_http_if_already_terminated
optional

false

If config.only_https is true, accepts HTTPs requests that have already been terminated by a proxy or load balancer and the x-forwarded-proto: https header has been added to the request. Only enable this option if the Kong server cannot be publicly accessed and the only entry-point is such proxy or load balancer.

Creating an SSL certificate

When creating an SSL certificate to use with this plugin, make sure you create one that is compatible with nginx. There are different ways of getting an SSL certificate, below you can find some easy steps to create a self-signed certificate to use with this plugin:

# Let's create the private server key
openssl genrsa -des3 -out server.key 2048

# Now we create a certificate signing request
openssl req -new -key server.key -out server.csr -sha256

# Remove the passphrase
cp server.key server.key.org
openssl rsa -in server.key.org -out server.key

# Signing the SSL certificate
openssl x509 -req -in server.csr -signkey server.key -out server.crt -sha256

If you followed the steps above the certificate will be stored in a file named server.crt, while the key is at server.key.


Propagation

When adding this plugin, the SSL certificate and its key will be uploaded and stored into the datastore, and they doesn't need to physically exist on the Kong servers.

For example, if you have two Kong servers called "Server_1" and "Server_2", this means that you can upload a certificate, let's say, on "Server_1" and it will be immediately available also on "Server_2" (and on any other server you decide to add to the cluster, as long as they point to the same datastore).

Keep up with the latest features