feat(ssl): add get_server_certificate function

lib/resty/openssl.lua

@@ -448,4 +448,11 @@ function _M.list_ssl_ciphers(cipher_list, ciphersuites, protocol)
   return ssl_lib.get_ciphers(ssl)
 end
 
+function _M.get_server_certificate(ssl_ptr)
+  local ssl = { ctx = ssl_ptr }
+
+  local ssl_lib = require("resty.openssl.ssl")
+  return ssl_lib.get_server_certificate(ssl)
+end
+
 return _M

lib/resty/openssl/include/ssl.lua

@@ -62,6 +62,8 @@ ffi.cdef [[
   int SSL_add_client_CA(SSL *ssl, X509 *cacert);
 
   long SSL_ctrl(SSL *ssl, int cmd, long larg, void *parg);
+
+  X509 *SSL_get_certificate(const SSL *ssl);
 ]]
 
 if OPENSSL_3X then

lib/resty/openssl/ssl.lua

@@ -141,6 +141,24 @@ function _M:get_peer_cert_chain()
   return chain_lib.dup(stack)
 end
 
+function _M:get_server_certificate()
+  local x509 = C.SSL_get_certificate(self.ctx)
+  if x509 == nil then
+    return nil
+  end
+  ffi.gc(x509, C.X509_free)
+
+  local err
+  -- always copy, although the ref counter of returned x509 is
+  -- already increased by one.
+  x509, err = x509_lib.dup(x509)
+  if err then
+    return nil, err
+  end
+
+  return x509
+end
+
 -- TLSv1.3
 function _M:set_ciphersuites(ciphers)
   if C.SSL_set_ciphersuites(self.ctx, ciphers) ~= 1 then

t/openssl/ssl/ssl_server.t

@@ -376,3 +376,40 @@ ok
 [emerg]
 --- skip_nginx
 2: < 9.9.9
+
+=== TEST 9: SSL (server) get_server_certificate
+--- http_config
+    server {
+        listen unix:/tmp/nginx-s9.sock ssl;
+        server_name   test.com;
+        ssl_protocols TLSv1.2;
+        ssl_certificate ../../../t/fixtures/test.crt;
+        ssl_certificate_key ../../../t/fixtures/test.key;
+        ssl_ciphers ECDHE-RSA-AES128-SHA;
+
+        location /t {
+            content_by_lua_block {
+                local ssl = require "resty.openssl.ssl"
+                local sess = myassert(ssl.from_request())
+
+                local crt = myassert(sess:get_server_certificate())
+                ngx.say(myassert(crt:get_subject_name():tostring()))
+            }
+        }
+    }
+--- config
+    location /t {
+        proxy_pass https://unix:/tmp/nginx-s9.sock:;
+        proxy_ssl_server_name on;
+        proxy_ssl_name test.com;
+        # valgrind be happy
+        proxy_ssl_session_reuse off;
+    }
+--- request
+    GET /t
+--- response_body
+CN=test.com
+
+--- no_error_log
+[error]
+[emerg]