Nginx – Why did the format of nginx $ssl_client_i_dn suddenly change

nginxsslssl-certificate

We are using client side certificates for authenticating one of our customers.

Our setup is this: We have nginx in front of a Django application. In our nginx config, we have the required parameters to get the actual client-side-certificate verification to work (ssl_client_certificate, ssl_verify_client etc) and

uwsgi_param X-Client-Verify $ssl_client_verify;
uwsgi_param X-Client-DN $ssl_client_s_dn;
uwsgi_param X-SSL-Issuer $ssl_client_i_dn;

which means that we get the values of those variables into our Django app. The Django app then uses this information to identify which user is connecting and authorize them.

We have successfully been using this for several months without any issue when suddenly we started getting reports about people not being able to log in using the certificates. It turned out that the format of the $ssl_client_s_dn and $ssl_client_i_dn values had changed, from a slash-separated format:

 /C=SE/O=Some organziation/CN=Some CA

to a comma-separated format:

CN=Some CA,O=Some organization,C=SE

Solving this was easy, but I don't understand why. So my questions is really:

From where does the value of $ssl_client_s_dn come? Is it set by nginx? The client?
Is there any documentation/specification of the format this value can have and does it have a name?

Best Answer

They changed because nginx changed them in release 1.11.6. As shown in the changelog:

    *) Change: format of the $ssl_client_s_dn and $ssl_client_i_dn variables
       has been changed to follow RFC 2253 (RFC 4514); values in the old
       format are available in the $ssl_client_s_dn_legacy and
       $ssl_client_i_dn_legacy variables.

If you want to avoid this sort of thing, you should stick to stable releases, rather than unstable mainline releases. Either way, you should test first before blindly upgrading production.

Related Solutions

Nginx – Convert HTACCESS mod_rewrite directives to nginx format

I convert part-by-part to follow more easily.

Apache:

RewriteCond %{HTTP_HOST} ^www.domain.com
RewriteRule (.*) http://domain.com/$1 [R=301,L]

Nginx:

server {
    listen 80;
    server_name www.domain.com;
    root /var/www/localhost/htdocs;

    rewrite ^ http://domain.com$request_uri permanent;
}

Apache:

RewriteCond %{THE_REQUEST} ^[A-Z]+\ /(index|index\.php)\ HTTP/
RewriteRule ^(index|index\.php)$ http://domain.com/ [R=301,L]

Nginx:

location = /index {
    try_files $uri @homepage;
}
location @homepage {
    rewrite ^ http://domain.com break;
}
location ~ \.php$ {
    if ($request_uri ~* /index\.php$) {
        rewrite ^ http://domain.com break;
    }
    fastcgi_pass 127.0.0.1:9000;
    include fastcgi.conf;

    fastcgi_intercept_errors        on;
    error_page 404 /error/404.php;
}

Apache:

RewriteCond %{DOCUMENT_ROOT}/$1.php -f
RewriteRule ^(.*)$ $1.php [L]

RewriteCond %{DOCUMENT_ROOT}/$1.php -f
RewriteRule ^(.*)/$ http://domain.com/$1 [R=301,L]

RewriteCond %{THE_REQUEST} ^[A-Z]+\ /[^.]+\.php\ HTTP/
RewriteCond %{DOCUMENT_ROOT}/$1.php -f
RewriteRule ^([^.]+)\.php$ http://domain.com/$1 [R=301,L]

Nginx:

rewrite ^/(.*)/$ /$1 permanent;

if (-f $document_root/$request_uri.php) {
    rewrite ^(.*)$ $1.php last;
}

location ~ \.php$ {
    if (-f $document_root/$request_uri) {
        rewrite ^([^.]+)\.php$ http://domain.com$1 permanent;
    }
    ...
}

Nginx Reverse Proxy – How to Set Up Nginx as Reverse Proxy with Upstream SSL

For anybody stumbling across this question that wants to use nginx you can set this up like any normal proxy, and to accept a self-signed certificate from the backend you need to provide the exported pem certificate (and perhaps a key) and set ssl verification off. For example:

...

server {
    listen       10.1.2.3:80;
    server_name  10.1.2.3 myproxy.mycompany.com;

    location / {
         proxy_pass                    https://backend.server.ip/;
         proxy_ssl_trusted_certificate /etc/nginx/sslcerts/backend.server.pem;
         proxy_ssl_verify              off;

         ... other proxy settings
    }

If your secure back end is using Server Name Identification SNI with multiple hosts being served per IP/Port pair you may also need to include proxy_ssl_server_name on; in the configuration. This works on nginx 1.7.0 and later.

Best Answer

Related Solutions

Nginx – Convert HTACCESS mod_rewrite directives to nginx format

Nginx Reverse Proxy – How to Set Up Nginx as Reverse Proxy with Upstream SSL

Related Topic