Conditional ssl_verify_client in NGINX

Question

I need to enable client certificate verification only for requests from outside of our intranet without verification for requests from, for example, 192.168.0.0/24. I tried to use geo module to define variable for internal subnet. In http context:

geo $intranet { 
  default 0; 
  192.168.0.0/24 1; 
}

In server context

if ($intranet != 1) { 
  ssl_verify_client on; 
} 

but it is impossible to use ssl_verify_client directive inside if statement. I get an error:

"ssl_verify_client" directive is not allowed here

Is there other way to do this?

Answer 1

Finally I found solution which works as expected.

In http context:

geo $intranet { 
  default 0; 
  192.168.0.0/23 1; 
}

In server context:

ssl_verify_client optional;

set $verify $intranet$ssl_client_verify;

if ($verify ~ (0NONE|0FAILED)) {
  return 403;
}