I'm wondering what's the best way to let users upload their SSL certificates. I have a multitenant application based on rails/passenger/nginx and I need each user to use his own domain with his SSL certificate. So what's the best approach to this problem. I don't feel like uploading the certificate and reloading nginx on each server each time a new certificate is uploaded is a good solution.
4
-
You didn't mention how you'd handle the key generation part. Is that because you already made up your mind about that? My recommendation would be that you generate the keypair to be used. Then provide the public key to the user through your own SSL enabled site - ideally formatted as a CSR. The user then take that public key to a CA and return to you with a certificate.– kasperdMar 26, 2015 at 10:31
-
Possibly related: security.stackexchange.com/q/84147/47143– kasperdMar 26, 2015 at 10:33
-
Ok, but when the user sends us a certificate, how would you plug it into nginx?– bukk530Mar 26, 2015 at 15:41
-
No idea. That's why I wrote a comment rather than an answer.– kasperdMar 26, 2015 at 16:06
Add a comment
|
1 Answer
You will need to signal nginx to reload TLS certificates. If you won't be doing that, there is no way what you wish is doable.
Part of the reason is checks are done at configuration loading time/statically (file existence, content validity, private key match, etc.) which cannot be reasonably done at access time/dynamically (when a request is processed), which would kill performance, and even the capability of serving any request in a reasonable amount of time at all!
Now, if reloading becomes acceptable to you, it would be unwise to make nginx allow people to drop files where nginx loads them, as you are providing a direct way to compromise your server(s), either intentionally/maliciously, or by accident if a user loads up a bad certificate, not being able to replace it since the server won't accept it!
Luckily for you, nginx has safeguard to prevent the latter and won't load an incorrect configuration. But for the sake of the first argument only, you shall use side-channels for this operation and never, ever, the same one.
