HTTPS/SSL calls with Lua and LuaSec

LuaSec module integrates with LuaSocket and provides HTTPS/SSL support for Lua socket operations. After you install LuaSocket and LuaSec, it only takes a couple of lines of code to make a call:

require("socket")
local https = require("ssl.https")
local body, code, headers, status = https.request("https://www.google.com")
print(status)

This should print HTTP/1.1 200 OK if your call is successful. If you need more control over the SSL configuration and the handshake steps, you can implement those steps yourself:

require("socket")
local ssl = require("ssl")

-- TLS/SSL client parameters (omitted)
local params = {
  mode = "client",
  protocol = "tlsv1",
  verify = "none",
  options = "all",
}

local conn = socket.tcp()
conn:connect("www.google.com", 443)

-- TLS/SSL initialization
conn = ssl.wrap(conn, params)
conn:dohandshake()

conn:send("GET / HTTP/1.1\n\n")
local line, err = conn:receive()
print(err or line)
conn:close()

Again, the steps are simple: open a TCP connection on port 443 (this is a default port for HTTPS), wrap a socket connection into SSL with specified parameters, do a handshake, and then use regular send/receive methods. This code should print HTTP/1.1 200 OK if the request is successful or an error, if not.

This code doesn't use certificate verification as we explicitly specified verify="none" in the parameter list. Certificate verification allows the client (your script in this case) to confirm that the site it is connected to has access to a valid certificate, signed by a certificate authority. This is the same process that your web browser does for you when you connect to a website over https:. To enable certificate verification in SSL verify="none" needs to be replaced with verify="peer". This is not enough, however: if you run this code with verify="peer", you will get: certificate verify failed error.

This error indicates that we requested certificate verification, but have no means to verify this certificate as we don't have any certificate authority certificates we can use to validate the signature on the certificate provided by the website we are connecting to. To do that, we need to find and download the file with these certificates; it comes with your browser, but can also be found online. For example, this site has the file with certificates used by mozilla.org and included with Firefox. You can download the file, save it, and then specify the location of the saved file as one of the parameters for SSL:

local params = {
  mode = "client",
  protocol = "tlsv1",
  cafile = "/path/to/downloaded/cacert.pem", --<-- added cafile parameters
  verify = "peer", --<-- changed "none" to "peer"
  options = "all",
}

You can now use the same script to connect to google.com (and other sites) over HTTPS and your script will verify the certificate provided by the site you are connected to.