Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does (or can) nginx log which certificates were used to log into a website?

I have configured nginx to perform ssl client authentication (with client pkcs12 files that I have signed with my own root certificate) the relevant portion of the config is:

        ssl on;
        ssl_certificate server_certificate
        ssl_certificate_key server_private_key
        ssl_client_certificate client_root_signing_certificate
        ssl_verify_client on;
        ssl_protocols SSLv3 TLSv1;
        ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP;
        ssl_prefer_server_ciphers on;

I believe that it is working correctly, but for every signed certificate I issue, I would like the certificate to be recorded so I can see what certificate was used to log in when. How can I set this up?

share|improve this question
up vote 1 down vote accepted

Add some SSL client cert variables to your log format (adjust to fit where and how your current logging it set up):

log_format combined_sslclient '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" "$ssl_client_s_dn($ssl_client_serial)"';
access_log log/access.log combined_sslclient
share|improve this answer
Thanks it works. Shane, do you know why some of the variables have to be in double quotes inside of single quotes (i.e. request and http_referer)? – tjb Mar 9 '12 at 21:23
They don't have to be at all - just makes for easier parsing for variables that can contain more complex strings. – Shane Madden Mar 10 '12 at 9:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.