I need to enable client certificate verification only for requests from outside of our intranet without verification for requests from, for example, I tried to use geo module to define variable for internal subnet. In http context:

geo $intranet { 
  default 0; 1; 

In server context

if ($intranet != 1) { 
  ssl_verify_client on; 

but it is impossible to use ssl_verify_client directive inside if statement. I get an error:

"ssl_verify_client" directive is not allowed here

Is there other way to do this?

1 Answer 1


Finally I found solution which works as expected.

In http context:

geo $intranet { 
  default 0; 1; 

In server context:

ssl_verify_client optional;

set $verify $intranet$ssl_client_verify;

if ($verify ~ (0NONE|0FAILED)) {
  return 403;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.