无需重启 NGINX 开源版即可实现 SSL/TLS 证书轮换

http {     ...    js_shared_dict_zone zone=kv:1m;   
    server {    …     # Sets an njs function for the variable. Returns a value of cert/key      js_set $dynamic_ssl_cert main.js_cert;      js_set $dynamic_ssl_key main.js_key;   
      # use variable's data      ssl_certificate data:$dynamic_ssl_cert;      ssl_certificate_key data:$dynamic_ssl_key;     
     # a location to clear cache    location = /clear {      js_content main.clear_cache;      # allow 127.0.0.1;      # deny all;    }  ...  }

function js_cert(r) {
  if (r.variables['ssl_server_name']) {    return read_cert_or_key(r, '.cert.pem');  } else {    return '';  }}
function js_key(r) {  if (r.variables['ssl_server_name']) {    return read_cert_or_key(r, '.key.pem');  } else {    return '';  }}/**    * Retrieves the key/cert value from Shared memory or fallback to disk   */  function read_cert_or_key(r, fileExtension) {    let data = '';    let path = '';    const zone = 'kv';    let certName = r.variables.ssl_server_name;    let prefix =  '/etc/nginx/certs/';    path = prefix + certName + fileExtension;    r.log('Resolving ${path}');    const key = ['certs', path].join(':');    const cache = zone && ngx.shared && ngx.shared[zone];   
    if (cache) {    data = cache.get(key) || '';    if (data) {      r.log(`Read ${key} from cache`);      return data;    }  }  try {    data = fs.readFileSync(path, 'utf8');    r.log('Read from cache');  } catch (e) {    data = '';    r.log(`Error reading from file:${path}. Error=${e}`);  }  if (cache && data) {    try {      cache.set(key, data);      r.log('Persisted in cache');    } catch (e) {      const errMsg = `Error writing to shared dict zone: ${zone}. Error=${e}`;      r.log(errMsg);    }  }
  return data}