3

Nginx's ssl_client_certificate and ssl_trusted_certificate directives can be used to allow client certificates signed by a given authority. But how can I allow specific certificates? I would like to filter by certificate fingerprint, or alternatively, by certificate authority + client cert serial number.

0
3

Nginx has access to the client certificate's fingerprint and serial number in $ssl_client_fingerprint and $ssl_client_serial, and the issuer's DN with $ssl_client_i_dn. See this document for details.

You can filter fingerprints by using a map.

For example:

map $ssl_client_fingerprint $reject {
    default 1;
    87654321abcdef9876543210fedcba123456789a 0;
    fe8765432176543210fedcba12345678abcdef98 0;
}
server {
    ...
    if ($reject) { return 403; }
    ...
}

See this document for details, and this caution on the use of if.

2
  • It has $ssl_client_i_dn for the immediate issuer. (In larger PKIs, just using the serial number alone might not be unique, but the combination of $ssl_client_i_dn and $ssl_client_serial ought to always be.) – user1686 Apr 20 '20 at 6:56
  • Thanks, I've added that variable to my answer. – Richard Smith Apr 20 '20 at 7:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.