0

I am responsible for a node application that uses client certificates to authenticate. If I connect directly to this application using HTTPS from a browser, I'm prompted for my client certificate and things work as expected.

If I disable https and run this as a HTTP server behind a HTTPS enabled nginx (using the same server key and cert) using proxy_pass, I am not prompted for the client certificate.

If I enabe https on the node application, I don't seem to be able to proxy pass it from nginx. I've tried changing proxy_pass http://my-upstream-entry to https://my-upstream-entry , but after that, I get messages similar to the following in the nginx error log:

2017/07/26 17:55:10 [error] 6687#6687: *380 upstream prematurely closed connection while reading response from upstream, client: 192.168.10.1, server: _, request: "GET /login HTTP/1.1", upstream: "http://127.0.0.1:1234/login"

Based on this, I have 2 questions:

  1. How do I proxy_pass to an TLS enabled node service ?
  2. Is it possible to pass through the request for the client certificate from the application and then pass the resulting certificate to the proxy_passed target ?

Thanks,

1

I don't think it is possible to pass the client certificate via nginx to the application server behind nginx while nginx acts as an TLS (SSL) endpoint. This is because TLS is an end-to-end encryption system between TLS client (browser) and TLS terminator (nginx or application server). All TLS operations (client / server authentication, encryption etc.) must happen on the client and server.

The error log entry in your question happens because nginx does not know how to handle client certificate requests.

I think your only alternatives are to either expose the application server directly for client connections, or proxy the actual TCP connections to the backend by using the nginx stream module.

Detailed explanation can be found here: https://serverfault.com/a/579668/423799

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.