Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have some URL's that I like protecting with ssl client certificates using directives like these in my apache configs:

SSLVerifyClient require
SSLVerifyDepth  10
SSLRequireSSL
SSLOptions +StrictRequire
SSLRequire %{REMOTE_ADDR} =~ m/^127\.0\.0\.1$/ \
  or ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
  and %{SSL_CLIENT_I_DN_CN} eq "xxx" \
  and %{SSL_CLIENT_S_DN_Email} in {"xx@xx.com", "xx@xx.com",} )

There don't seem to be any nginx directives to handle this, so I assume I have to pass everything on to Apache backend.

Which brings me to my question, how to pass encrypted ssl? All the proxying is decrypting the ssl packets at nginx level before passing them on to Apache.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

If you want Apache to handle the SSL verification, then you'll need to put it in front of nginx, or else do some crazy stuff with passing the client DN to Apache via a custom header or something -- an awful lot of work.

There are some facilities for doing DN checking in nginx, though; the Nginx HTTP SSL module docs give the possible variables (right down the bottom, and unfortunately the markup's stuffed so there's no header for it) but $ssl_client_s_dn should be what you're looking for, and you can use nginx's programming-like directives (if $ssl_client_s_dn ~= CN=something_or_other kind of thing) to redirect or return a 403 if you don't like the certificate presented. It'll be very different to what you're used to with Apache, but ultimately Apache's way of doing this sort of thing isn't an oil painting either, so it all depends on which ugly you prefer...

I'm curious, though, as to why you'd put nginx in front of Apache... either of them should be capable of doing the whole job of serving web pages.

share|improve this answer
    
Ok, I'll look into the directives bit. I'm running nginx in front of Apache because I need multiple "all ssl" virtual hosts and SNI seems pretty sketchy. I still need Apache primarily because of mod_wsgi for Django apps as well as passenger for RoR and php-fpm. I had a highly tuned Apache before needing multiple SSL sites so wouldn't have changed otherwise. As it turns out nginx reduced my ssl page loads by around .3 secs or so and is fantastic on the static files so it was a great change. –  Van Gale Aug 30 '09 at 4:57
    
Ok, got it working using something pretty close to the direction you pointed. –  Van Gale Aug 31 '09 at 8:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.