I need to be able to present the web client accessing my site two certificates signed by two different CAs, if the client doesn't trust one, it should pick up the other one. Is there a way to do that? I am running NGINX under an Ubuntu 16.04.3 vm.
-
1yes, see this question serverfault.com/questions/412432/… if you have nginx 1.11.0+ and opensl 1.0.2+ you can have multiple certificate chains nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate– ralzOct 7, 2017 at 2:04
Add a comment
|
1 Answer
if you have nginx 1.11.0+ and opensl 1.0.2+ you can have multiple certificate chains
From http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate
Since version 1.11.0, this directive can be specified multiple times to load certificates of different types, for example, RSA and ECDSA:
server {
listen 443 ssl;
server_name example.com;
ssl_certificate example.com.rsa.crt;
ssl_certificate_key example.com.rsa.key;
ssl_certificate example.com.ecdsa.crt;
ssl_certificate_key example.com.ecdsa.key;
...
}
Only OpenSSL 1.0.2 or higher supports separate certificate chains for different certificates. With older versions, only one certificate chain can be used.
-
Is there a preference for one over the other? Say a client actually has both CAs as trusted on their machines, which one is going to be accepted?– FacundoOct 7, 2017 at 2:45
-
if you use RSA and ECDSA certificates you can user ssl_ciphers to prioritize one over another as described here scotthelme.co.uk/hybrid-rsa-and-ecdsa-certificates-with-nginx– ralzOct 7, 2017 at 3:17
-
I tried doing this with two RSA certificate/keys but it threw an error stating that I already defined those– FacundoOct 7, 2017 at 5:10
-
The documentation implies that the certificates must be of different types. However, I don't think even this would fix the trust issue you are having, since it is the actually client making the decision whether to trust a certificate or not. Oct 7, 2017 at 10:13
-
1I think it is the server that decides the certificate to give to the client based on the certificate types the client supports. If that certificate is not OK for the client, then it displays an error. I am not 100% sure, but I don't think the server can send two certificates at the same time and let client choose which one to use. Oct 7, 2017 at 22:54