Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let's say I have two Apache servers (one per vhost) behind an nginx server.

The problem is that I'd like Apache to do the authentication of client certificates.

Would it be possible for nginx to do the SNI part of SSL (so it knows to which Apache instance to forward to), and forward the rest to Apache?

share|improve this question
up vote 1 down vote accepted

I don't believe so, since the SSL client as far as Apache's concerned is the nginx server. The nginx proxy can't have the client's private key, so it can't act as the client for authentication purposes when communicating with the Apache servers.

The device communicating with the client needs to be the one dealing with any client authentication - so this probably isn't feasible.

share|improve this answer
SNI happens before certificate auth, so it's possible in theory. – Vladimir Panteleev Feb 12 '12 at 4:29
Sure, it's possible - just not with nginx, because nginx would be the SSL endpoint that the client's talking to, not Apache. But yes, it's definitely possible when the proxy isn't in on the SSL. The implementation of SNI is very simple, a simple TCP proxy could just read the extension field in the client hello packet and make a decision from there on where to proxy the client to. It looks like HAProxy might actually have this in the works - if you're feeling adventurous, maybe see if this does what you need? – Shane Madden Feb 12 '12 at 5:03
I'll have a look, thanks! – Vladimir Panteleev Feb 12 '12 at 6:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.