I have Nginx 1.10 with ssl_verify_client = on. Everything works fine, except that the server finishes TLS handshake and proceeds to parse the headers even though the certificate hasn't been sent by the client.
It can be verified by sending http request without client certificate and extremely big http header, nginx returns "400 Request Header Or Cookie Too Large".
According to our security auditor, the server should fail the TLS handshake, because parsing the headers "increases the possible attack surface.
My nginx config:
server {
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
server_name myserver.com;
ssl_certificate /etc/letsencrypt/live/myserver.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/myserver.com/privkey.pem;
ssl_verify_client on;
ssl_client_certificate /etc/nginx/ssl/ca.pem;
location / {
proxy_pass http://127.0.0.1:8001;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
} }