Nginx's ssl_client_certificate and ssl_trusted_certificate directives can be used to allow client certificates signed by a given authority. But how can I allow specific certificates? I would like to filter by certificate fingerprint, or alternatively, by certificate authority + client cert serial number.


1 Answer 1


Nginx has access to the client certificate's fingerprint and serial number in $ssl_client_fingerprint and $ssl_client_serial, and the issuer's DN with $ssl_client_i_dn. See this document for details.

You can filter fingerprints by using a map.

For example:

map $ssl_client_fingerprint $reject {
    default 1;
    87654321abcdef9876543210fedcba123456789a 0;
    fe8765432176543210fedcba12345678abcdef98 0;
server {
    if ($reject) { return 403; }

See this document for details, and this caution on the use of if.

  • It has $ssl_client_i_dn for the immediate issuer. (In larger PKIs, just using the serial number alone might not be unique, but the combination of $ssl_client_i_dn and $ssl_client_serial ought to always be.) Apr 20, 2020 at 6:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .