Quantcast
Channel: Nginx Forum - How to...
Viewing all articles
Browse latest Browse all 4759

Client certificate based AUTH (ssl_client_certificate vs ssl_trusted_certificate)

$
0
0
Hello,
I have client certificate based authorization defined in nginx as follows:


ssl_client_certificate /path/to/MY_CA_ROOT.pem;
ssl_verify_client optional;
ssl_verify_depth 2;

#special location - admin only access (with client cert signed by CA)
location /myApp/admin/{
if ($ssl_client_verify != SUCCESS) { return 403; }
}

Now, according to official documentation: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_client_certificate

I wanted to change ssl_client_certificate in favor of ssl_trusted_certificate.

But when I do so:
instead of:

#ssl_client_certificate /path/to/MY_CA_ROOT.pem;
I set:
ssl_trusted_certificate /path/to/MY_CA_ROOT.pem;



Nginx complains:

nginx: [emerg] no ssl_client_certificate for ssl_client_verify


Are those two directives compatible or am I getting in wrong?

DOC says:
Specifies a file with trusted CA certificates in the PEM format used to verify client certificates and OCSP responses if ssl_stapling is enabled.

In contrast to the certificate set by ssl_client_certificate, the list of these certificates will not be sent to clients.

Viewing all articles
Browse latest Browse all 4759

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>