How to allow specific SSL client certificates in Nginx?

Question

Nginx's ssl_client_certificate and ssl_trusted_certificate directives can be used to allow client certificates signed by a given authority. But how can I allow specific certificates? I would like to filter by certificate fingerprint, or alternatively, by certificate authority + client cert serial number.

Answer 1

Nginx has access to the client certificate's fingerprint and serial number in $ssl_client_fingerprint and $ssl_client_serial, and the issuer's DN with $ssl_client_i_dn. See this document for details.

You can filter fingerprints by using a map.

For example:

map $ssl_client_fingerprint $reject {
    default 1;
    87654321abcdef9876543210fedcba123456789a 0;
    fe8765432176543210fedcba12345678abcdef98 0;
}
server {
    ...
    if ($reject) { return 403; }
    ...
}

See this document for details, and this caution on the use of if.