Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an nginx server which I'd like to add client SSL certificate authentication to. I use a system (GitLab) which needs to call out to itself internally for commit hooks and the like. Is there a way to setup SSL with client SSL for all remote (not local) clients?

I'd like to make it so that GitLab can call itself without a client cert, but all remote clients must authenticate with a client SSL certificate.

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

Without knowing anything about GitLab, it seems like it would be fairly easy to do this with virtual hosts. Create two virtual hosts, one with TLS client authentication for client access, and a second for local access from GitLab. For example:

server {
  # Listen on your externally accessible address
  listen        10.0.0.1:443;
  ssl on;
  server_name example.com;

  ssl_certificate      /etc/nginx/certs/server.crt;
  ssl_certificate_key  /etc/nginx/certs/server.key;
  ssl_client_certificate /etc/nginx/certs/ca.crt;
  ssl_verify_client on;

  include shared.conf;
}

server {
  # Listen on localhost or some internal-only address
  listen        127.0.0.1:443;
  ssl on;
  server_name localhost;

  ssl_certificate      /etc/nginx/certs/server.crt;
  ssl_certificate_key  /etc/nginx/certs/server.key;
  ssl_client_certificate /etc/nginx/certs/ca.crt;
  ssl_verify_client optional;

  include shared.conf;
}

Put any config that should be shared by both virtual hosts inside shared.conf to avoid duplication.

share|improve this answer
    
Instead of binding to localhost, could I just create a local domain name so that I can use something like git.local.mydomainname.com? Would that make more sense and leave localhost unbound? –  Naftuli Tzvi Kay Jul 19 '13 at 19:10
1  
Sure, it doesn't need to be localhost. Add a second internal-only IP address to the box and add your local DNS entry for that new IP. Ensure the second IP is not accessible to external clients though. –  Vortura Jul 22 '13 at 9:54
    
Using two DNS names for the same IP and then using the name to select a virtual host would not be a good idea. You might be able to get it working using SNI, but it would be easily circumvented by an external user who knew the 'local' name. –  Vortura Jul 22 '13 at 11:48
    
How would it be circumvented externally? If I make the host only listen on 127.0.0.1 under the name git.local.mydomainname.com, only a local request originating from the server would be able to access that host right? Is it easy enough to spoof the originating IP address? –  Naftuli Tzvi Kay Jul 22 '13 at 19:30
    
Sorry, all I meant was that assigning two names to your external IP, and then using the name to determine whether to use client cert authentication would be a bad idea. By using localhost or another internal-only IP for local access, external users won't be able to connect to the unauthenticated virtual host at all. –  Vortura Jul 23 '13 at 8:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.