Nginx – How to use ssl_verify_client=ON on one virtual server and ssl_verify_client=OFF on another

nginxsslweb

I want to force ssl client verification for on of my virtual hosts. But get "No required SSL certificate was sent" error, trying to GET something from it.

Here are my test configs:

# defaults                                                                                                                                                                    
ssl_certificate /etc/certs/server.cer;                                                                                                                                 
ssl_certificate_key /etc/certs/privkey-server.pem;                                                                                                                     
ssl_client_certificate /etc/certs/allcas.pem;                                                                                                                                 

server {                                                                                                                                                                      
    listen 1443 ssl;                                                                                                                                                          
    server_name server1.example.com;                                                                                                                                          
    root /tmp/root/server1;                                                                                                                                                   

    ssl_verify_client off;                                                                                                                                                    
}                                                                                                                                                                             

server {                                                                                                                                                                      
    listen 1443 ssl;                                                                                                                                                          
    server_name server2.example.com;                                                                                                                                          
    root /tmp/root/server2;                                                                                                                                                   

    ssl_verify_client on;                                                                                                                                                     
}

First server replies with 200 http code, but second returns "400 Bad Request, No required SSL certificate was sent, nginx/1.0.4".

Probably, it is implossible to use ssl_verify_client on the same IP? Should I bind these servers to different IPs, will it solve my problem?

Best Answer

I ran into a similar problem, but looking to distinguish the ssl_verify_clients between location blocks within a server block, rather than between server blocks. You could probably solve your problem by moving the default ssl config stuff into the two servers (duplicating it, sure, or put them all in one server block, accept the multiple sub-domains, and use locations).

For the location based solution, looks like the following works. Use

ssl_verify_client optional;

in the server block, and use if-statements in the various locations, eg:

if ($ssl_client_verify != SUCCESS) { return 403; }

I needed to do this to give admin access to an webapp, yet still allow webhooks from github without giving github a client ssl cert.

Related Solutions

Nginx – How to Redirect One Path to Another

Direct quote from Pitfalls and Common Mistakes: Taxing Rewrites:

By using the return directive we can completely avoid evaluation of regular expression.

Please use return instead of rewrite for permanent redirects. Here's my approach to this use-case...

location = /content/unique-page-name {
  return 301 /new-name/unique-page-name;
}

Nginx – How to Use Environment Variables in Nginx.conf

From the official Nginx docker file:

Using environment variables in nginx configuration:

Out-of-the-box, Nginx doesn't support using environment variables inside most configuration blocks.

But envsubst may be used as a workaround if you need to generate your nginx configuration dynamically before nginx starts.

Here is an example using docker-compose.yml:

image: nginx
volumes:
 - ./mysite.template:/etc/nginx/conf.d/mysite.template
ports:
 - "8080:80"
environment:
 - NGINX_HOST=foobar.com
 - NGINX_PORT=80
command: /bin/bash -c "envsubst < /etc/nginx/conf.d/mysite.template > /etc/nginx/conf.d/default.conf && nginx -g 'daemon off;'"

The mysite.template file may then contain variable references like this :

listen ${NGINX_PORT};

Update:

But you know this caused to its Nginx variables like this:

proxy_set_header        X-Forwarded-Host $host;

damaged to:

proxy_set_header        X-Forwarded-Host ;

So, to prevent that, i use this trick:

I have a script to run Nginx, that used on the docker-compose file as command option for Nginx server, i named it run_nginx.sh:

#!/usr/bin/env bash
export DOLLAR='$'
envsubst < nginx.conf.template > /etc/nginx/nginx.conf
nginx -g "daemon off;"

And because of defined new DOLLAR variable on run_nginx.sh script, now content of my nginx.conf.template file for Nginx itself variable is like this:

proxy_set_header        X-Forwarded-Host ${DOLLAR}host;

And for my defined variable is like this:

server_name  ${WEB_DOMAIN} www.${WEB_DOMAIN};

Also here, there is my real use case for that.

Best Answer

Related Solutions

Nginx – How to Redirect One Path to Another

Nginx – How to Use Environment Variables in Nginx.conf

Related Topic