1

Does (or can) nginx log which certificates were used to log into a website?

I have configured nginx to perform ssl client authentication (with client pkcs12 files that I have signed with my own root certificate) the relevant portion of the config is:

        ssl on;
        ssl_certificate server_certificate
        ssl_certificate_key server_private_key
        ssl_client_certificate client_root_signing_certificate
        ssl_verify_client on;
        ssl_protocols SSLv3 TLSv1;
        ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP;
        ssl_prefer_server_ciphers on;

I believe that it is working correctly, but for every signed certificate I issue, I would like the certificate to be recorded so I can see what certificate was used to log in when. How can I set this up?

1

Add some SSL client cert variables to your log format (adjust to fit where and how your current logging it set up):

log_format combined_sslclient '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" "$ssl_client_s_dn($ssl_client_serial)"';
access_log log/access.log combined_sslclient
  • Thanks it works. Shane, do you know why some of the variables have to be in double quotes inside of single quotes (i.e. request and http_referer)? – tjb Mar 9 '12 at 21:23
  • They don't have to be at all - just makes for easier parsing for variables that can contain more complex strings. – Shane Madden Mar 10 '12 at 9:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.