In addition to usual CA chain validation, I would like Nginx server
section to permit specific client certificate thumbprints only.
I could find how to check for single fingerprint, but I'm not sure how to combine multiple fingerprints because Nginx does not support or
, and map
is not allowed inside server
sections.
So, now I have an ugly workaround like this:
ssl_client_certificate /usr/local/share/ca-certificates/trusted_chain.pem;
ssl_verify_client on;
ssl_verify_depth 3;
if ( $ssl_client_fingerprint = "12a4f0abc935cc0dd0f6fdcc0d56682d7f5c15a1" ) {
set $whiteclient 1;
}
if ( $ssl_client_fingerprint = "12a4f0abc935cc0dd0f6fdcc0d56682d7f5c15a2" ) {
set $whiteclient 1;
}
if ( $ssl_client_fingerprint = "12a4f0abc935cc0dd0f6fdcc0d56682d7f5c15a3" ) {
set $whiteclient 1;
}
if ( $whiteclient != 1 ) {
return 403;
}
Is there any nicer way to do this?
map
being unavailable inserver
sections a problem here? You are checking SHA1 hashes of certs signed by a known entity, would be quite odd to encounter collisions there..map
was available, I could avoid those uglyif
s. Also, I hoped that some better, built-in way to create a fingerprint whitelist exists.map
for. They don't go inserver
blocks. They go outsideserver
blocks.ssl_client_certificate
andssl_verify_client
are both defined inside only oneserver
block (because I have multiple server sections), will amap
outside still work correctly with the$ssl_client_fingerprint
variable? Will Nginx process this variable when it haven't yet routed the request to theserver
section that enables client certificate processing?