Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have some URL's that I like protecting with ssl client certificates using directives like these in my apache configs:

SSLVerifyClient require
SSLVerifyDepth  10
SSLOptions +StrictRequire
SSLRequire %{REMOTE_ADDR} =~ m/^127\.0\.0\.1$/ \
  or ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
  and %{SSL_CLIENT_I_DN_CN} eq "xxx" \
  and %{SSL_CLIENT_S_DN_Email} in {"", "",} )

There don't seem to be any nginx directives to handle this, so I assume I have to pass everything on to Apache backend.

Which brings me to my question, how to pass encrypted ssl? All the proxying is decrypting the ssl packets at nginx level before passing them on to Apache.

share|improve this question
You should ask a question about how to do what you want with Nginx. Downgrading back to Apache is not the solution. Using Django (you said mod_wsgi in another comment) can be done in Nginx easily. I do this for MANY sites. Look into uwsgi and Nginx. If you find Apache to be faster, your config is wrong. Ask those questions. – David Betz Feb 16 at 21:14
up vote 2 down vote accepted

If you want Apache to handle the SSL verification, then you'll need to put it in front of nginx, or else do some crazy stuff with passing the client DN to Apache via a custom header or something -- an awful lot of work.

There are some facilities for doing DN checking in nginx, though; the Nginx HTTP SSL module docs give the possible variables (right down the bottom, and unfortunately the markup's stuffed so there's no header for it) but $ssl_client_s_dn should be what you're looking for, and you can use nginx's programming-like directives (if $ssl_client_s_dn ~= CN=something_or_other kind of thing) to redirect or return a 403 if you don't like the certificate presented. It'll be very different to what you're used to with Apache, but ultimately Apache's way of doing this sort of thing isn't an oil painting either, so it all depends on which ugly you prefer...

I'm curious, though, as to why you'd put nginx in front of Apache... either of them should be capable of doing the whole job of serving web pages.

share|improve this answer
Ok, I'll look into the directives bit. I'm running nginx in front of Apache because I need multiple "all ssl" virtual hosts and SNI seems pretty sketchy. I still need Apache primarily because of mod_wsgi for Django apps as well as passenger for RoR and php-fpm. I had a highly tuned Apache before needing multiple SSL sites so wouldn't have changed otherwise. As it turns out nginx reduced my ssl page loads by around .3 secs or so and is fantastic on the static files so it was a great change. – Van Gale Aug 30 '09 at 4:57
Ok, got it working using something pretty close to the direction you pointed. – Van Gale Aug 31 '09 at 8:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.