I have an nginx instance serving a web application over HTTPS. The web application serves both browsers and native mobile apps. The native mobile apps use client certificates as an additional layer of authentication, while the web browser uses only username/password. The browser and mobile apps use different paths, but the same TCP endpoint (IP/port).
The problem is that the web browser pops up a dialog prompting the user to specify a client certificate. It is perfectly fine to just cancel this dialog, as it is configured to be optional in nginx and validation of the certificate is done on the application side. However, this is very confusing to users, and I need to figure out a way of not showing the dialog.
My requirements:
- It would be very hard to have different endpoints (need to be port 443 on both, and allocating a new IP will be difficult). Please do not suggest changing endpoints. I am well aware of this solution and this is plan B if everything else is absolutely impossible, but this will involve lots and lots and lots of IT headache. It is easily worth a couple of days of development to avoid changing endpoints.
- Other than changing endpoint, I have full control over the client code (i.e. mobile app), as well as the server deployment. I could change protocols as necessary, but it needs to support HTTPS in a "normal" browser.
- If it is difficult to have different client side certificate settings per path (which this old thread seems to indicate), I could resort to selection based on user agents instead. This is no security issue, as the application verifies that a certificate was used for the "sensitive" paths.
- If Nginx cannot do it, I would be happy to switch to another reverse proxy that can handle it. (Traefik, Apache, ...?)