NGINX configures SSL two-way authentication
Background
For NGINX’s HTTPS configuration, usually we only need to implement server-side authentication, because the browser has built-in some trusted certificate authorities (CA), and the server-side only needs to obtain the certificates issued by these organizations and Once configured, the browser will verify the validity of the certificate itself and encrypt communications via SSL.
But in special cases we also need to verify the client. Only trusted clients can use the service interface. At this time we need to enable two-way authentication to achieve this purpose. Only when the client requests an available certificate can Adjust the server interface.
CA and self-signed
CA can only be done by authoritative organizations, and if the organization fails to meet security standards, it will be "blocked" by browser manufacturers. Not long ago, WoSign and StartSSL were blocked by Mozilla and Chrome. However, this does not affect our two-way authentication configuration, because we build our own CA...
For convenience, we make certificate-related production in the NGINX directory:
cd /etc/nginx mkdir sslcd ssl
Make CA private key
openssl genrsa -out ca.key 2048
Make CA root Certificate (Public Key)
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt
Note:
Common Name can be filled in at will
Other information that needs to be filled in. In order to avoid errors, fill it in. Let’s
Server-side certificate
Make server-side private key
openssl genrsa -out server.pem 1024 openssl rsa -in server.pem -out server.key
Generate and issue Request
openssl req -new -key server.pem -out server.csr
Note:
Common Name must be filled in as the domain name when accessing the service. Here we use usb.dev. The following NGINX configuration will use
Other information that needs to be filled in. In order to avoid errors, fill in . CA root certificate matching)
Issued with CA
openssl x509 -req -sha256 -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -days 3650 -out server.crt
Client certificate
Similar to the server certificate:
Note:
Common Name can be filled in at will
Other information that needs to be filled in. In order to avoid errors, fill in . (in order to match the CA root certificate)
Now you have all the required certificates Okay, we can start configuring NGINX.
NGINX
server {
listen 443 ssl;
server_name usb.dev;
access_log off;
ssl on;
ssl_certificate /etc/nginx/ssl/server.crt;
ssl_certificate_key /etc/nginx/ssl/server.key;
ssl_client_certificate /etc/nginx/ssl/ca.crt;
ssl_verify_client on;
location / {
proxy_pass http://backend$request_uri;
}
}where ssl_client_certificate /etc/nginx/ssl/ca.crt; means to use the CA certificate to verify whether the client certificate in the request is issued by the CA.
After configuring, reload NGINX:
service nginx reload
Okay, now we can start verification.
Request verification
The verification process can be done on other machines or on this machine. In order to be able to parse usb.dev, you also need to configure /etc/hosts:
127.0.0.1 usb.dev
If you use a browser to verify, you need to export the client certificate to p12 format, skip here. Our focus is on verification through curl:
curl --insecure --key client.key --cert client.crt 'https://usb.dev'
where --insecure is to ignore the non-authoritative nature of the self-built CA. If your verification is normal, you are in luck, because there is a deep pit here: some versions of curl will report errors:
<html> <head><title>400 No required SSL certificate was sent</title></head> <body bgcolor="white"> <center><h1>400 Bad Request</h1></center> <center>No required SSL certificate was sent</center> <hr><center>nginx/1.11.0</center> </body> </html>
These error-reporting versions of curl actually have to strictly require that the path of the --cert actual parameter must be completely correct, such as the current You need to use --cert ./client.crt under the directory. It is wrong to use --cert client.crt. During the pit climbing process, the -v parameter was enabled to observe the complete process, and an alarm was found:
warning: certificate file name "client.crt" handled as nickname; please use "./client.crt" to force file name
Hot AI Tools
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Undress AI Tool
Undress images for free
Clothoff.io
AI clothes remover
Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!
Hot Article
Hot Tools
Notepad++7.3.1
Easy-to-use and free code editor
SublimeText3 Chinese version
Chinese version, very easy to use
Zend Studio 13.0.1
Powerful PHP integrated development environment
Dreamweaver CS6
Visual web development tools
SublimeText3 Mac version
God-level code editing software (SublimeText3)
Hot Topics
1670
14
1428
52
1329
25
1273
29
1256
24
How to configure nginx in Windows
Apr 14, 2025 pm 12:57 PM
How to configure Nginx in Windows? Install Nginx and create a virtual host configuration. Modify the main configuration file and include the virtual host configuration. Start or reload Nginx. Test the configuration and view the website. Selectively enable SSL and configure SSL certificates. Selectively set the firewall to allow port 80 and 443 traffic.
How to start containers by docker
Apr 15, 2025 pm 12:27 PM
Docker container startup steps: Pull the container image: Run "docker pull [mirror name]". Create a container: Use "docker create [options] [mirror name] [commands and parameters]". Start the container: Execute "docker start [Container name or ID]". Check container status: Verify that the container is running with "docker ps".
How to check the name of the docker container
Apr 15, 2025 pm 12:21 PM
You can query the Docker container name by following the steps: List all containers (docker ps). Filter the container list (using the grep command). Gets the container name (located in the "NAMES" column).
How to check whether nginx is started
Apr 14, 2025 pm 01:03 PM
How to confirm whether Nginx is started: 1. Use the command line: systemctl status nginx (Linux/Unix), netstat -ano | findstr 80 (Windows); 2. Check whether port 80 is open; 3. Check the Nginx startup message in the system log; 4. Use third-party tools, such as Nagios, Zabbix, and Icinga.
How to create containers for docker
Apr 15, 2025 pm 12:18 PM
Create a container in Docker: 1. Pull the image: docker pull [mirror name] 2. Create a container: docker run [Options] [mirror name] [Command] 3. Start the container: docker start [Container name]
How to check nginx version
Apr 14, 2025 am 11:57 AM
The methods that can query the Nginx version are: use the nginx -v command; view the version directive in the nginx.conf file; open the Nginx error page and view the page title.
How to configure cloud server domain name in nginx
Apr 14, 2025 pm 12:18 PM
How to configure an Nginx domain name on a cloud server: Create an A record pointing to the public IP address of the cloud server. Add virtual host blocks in the Nginx configuration file, specifying the listening port, domain name, and website root directory. Restart Nginx to apply the changes. Access the domain name test configuration. Other notes: Install the SSL certificate to enable HTTPS, ensure that the firewall allows port 80 traffic, and wait for DNS resolution to take effect.
What to do if nginx server is hung
Apr 14, 2025 am 11:42 AM
When the Nginx server goes down, you can perform the following troubleshooting steps: Check that the nginx process is running. View the error log for error messages. Check the syntax of nginx configuration. Make sure nginx has the permissions you need to access the file. Check file descriptor to open limits. Confirm that nginx is listening on the correct port. Add firewall rules to allow nginx traffic. Check reverse proxy settings, including backend server availability. For further assistance, please contact technical support.
