Hello,
I have client certificate based authorization defined in nginx as follows:
ssl_client_certificate /path/to/MY_CA_ROOT.pem;
ssl_verify_client optional;
ssl_verify_depth 2;
#special location - admin only access (with client cert signed by CA)
location /myApp/admin/{
if ($ssl_client_verify != SUCCESS) { return 403; }
}
Now, according to official documentation: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_client_certificate
I wanted to change ssl_client_certificate in favor of ssl_trusted_certificate.
But when I do so:
instead of:
#ssl_client_certificate /path/to/MY_CA_ROOT.pem;
I set:
ssl_trusted_certificate /path/to/MY_CA_ROOT.pem;
Nginx complains:
nginx: [emerg] no ssl_client_certificate for ssl_client_verify
Are those two directives compatible or am I getting in wrong?
DOC says:
Specifies a file with trusted CA certificates in the PEM format used to verify client certificates and OCSP responses if ssl_stapling is enabled.
In contrast to the certificate set by ssl_client_certificate, the list of these certificates will not be sent to clients.
I have client certificate based authorization defined in nginx as follows:
ssl_client_certificate /path/to/MY_CA_ROOT.pem;
ssl_verify_client optional;
ssl_verify_depth 2;
#special location - admin only access (with client cert signed by CA)
location /myApp/admin/{
if ($ssl_client_verify != SUCCESS) { return 403; }
}
Now, according to official documentation: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_client_certificate
I wanted to change ssl_client_certificate in favor of ssl_trusted_certificate.
But when I do so:
instead of:
#ssl_client_certificate /path/to/MY_CA_ROOT.pem;
I set:
ssl_trusted_certificate /path/to/MY_CA_ROOT.pem;
Nginx complains:
nginx: [emerg] no ssl_client_certificate for ssl_client_verify
Are those two directives compatible or am I getting in wrong?
DOC says:
Specifies a file with trusted CA certificates in the PEM format used to verify client certificates and OCSP responses if ssl_stapling is enabled.
In contrast to the certificate set by ssl_client_certificate, the list of these certificates will not be sent to clients.