1

I have Nginx running as a proxy to a web server and i want to securing Access using TLS/SSL Client Certificates.

This is my ssl config

server {
    listen                  443 ssl; 
    server_name             www.domain.com;
    ssl_certificate         /etc/nginx/ssl/domain/server.crt; 
    ssl_certificate_key     /etc/nginx/ssl/domain/server.key; 
    ssl_client_certificate  /etc/nginx/ssl/clients/client_ca.pem
    ssl_verify_client on;

it works very good - but now i need to allow access to my site without client certificates from one specific IP address.

is there a posibility to do this with nginx?

thank you :-)

4

This is my Solution:

server {
    listen                  443 ssl; 
    server_name             www.domain.com;
    ssl_certificate         /etc/nginx/ssl/domain/server.crt; 
    ssl_certificate_key     /etc/nginx/ssl/domain/server.key; 
    ssl_client_certificate  /etc/nginx/ssl/clients/client_ca.pem
    ssl_verify_client       optional;

    # Set global proxy settings
    proxy_read_timeout      360;
    proxy_pass_header       Date;
    proxy_pass_header       Server;
    proxy_set_header        Host $host;
    proxy_set_header        X-Real-IP $remote_addr;
    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header        Accept-Encoding "";


    location /
    {

    if ($remote_addr = 1.2.3.4 ) 
       {
        proxy_pass http://10.10.10.1; 
        break; 
       }

    if ($ssl_client_verify != "SUCCESS") 
       { return 403; }

    proxy_pass http://10.10.10.1;}

    error_log /var/log/nginx/domain-error.log;
    access_log /var/log/nginx/domain-access.log;
}

the ip 1.2.3.4 can acces the website without a client cert :-)

0

The simple solution would be to create a duplicate server container with a different domain name which has ssl_verify_client turned off, and some form of allow/deny scheme in place.

It is possible to set ssl_verify_client optional and then manually verify the client, but your clients are prompted for a certificate anyway, so it can be annoying for your users.

  • I cant config a second DNS-name - it should be the same DNS-Name from anywhere... – schaloml Dec 10 '15 at 8:50

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.