1

I need to be able to present the web client accessing my site two certificates signed by two different CAs, if the client doesn't trust one, it should pick up the other one. Is there a way to do that? I am running NGINX under an Ubuntu 16.04.3 vm.

1

1 Answer 1

0

if you have nginx 1.11.0+ and opensl 1.0.2+ you can have multiple certificate chains

From http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate


Since version 1.11.0, this directive can be specified multiple times to load certificates of different types, for example, RSA and ECDSA:

server {
    listen              443 ssl;
    server_name         example.com;

    ssl_certificate     example.com.rsa.crt;
    ssl_certificate_key example.com.rsa.key;

    ssl_certificate     example.com.ecdsa.crt;
    ssl_certificate_key example.com.ecdsa.key;

    ...
}

Only OpenSSL 1.0.2 or higher supports separate certificate chains for different certificates. With older versions, only one certificate chain can be used.

6
  • Is there a preference for one over the other? Say a client actually has both CAs as trusted on their machines, which one is going to be accepted?
    – Facundo
    Oct 7, 2017 at 2:45
  • if you use RSA and ECDSA certificates you can user ssl_ciphers to prioritize one over another as described here scotthelme.co.uk/hybrid-rsa-and-ecdsa-certificates-with-nginx
    – ralz
    Oct 7, 2017 at 3:17
  • I tried doing this with two RSA certificate/keys but it threw an error stating that I already defined those
    – Facundo
    Oct 7, 2017 at 5:10
  • The documentation implies that the certificates must be of different types. However, I don't think even this would fix the trust issue you are having, since it is the actually client making the decision whether to trust a certificate or not. Oct 7, 2017 at 10:13
  • 1
    I think it is the server that decides the certificate to give to the client based on the certificate types the client supports. If that certificate is not OK for the client, then it displays an error. I am not 100% sure, but I don't think the server can send two certificates at the same time and let client choose which one to use. Oct 7, 2017 at 22:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.