Hi all,

I have published an internal web site with HTTPS and set the ssl_verify_client on. I need some fields from the client certificate to send them to the back-end web server, so I can correctly access a specific database.

It's working but I also need to redirect the client to a second internal website in case his certificate is missing or is invalid.
I have tried to capture the error page that I've got in the browser (when I don't send a client certificate) and put a redirect link in that error page. The second website will generate the client certificates based on a user and password.

I am trying to avoid to give 2 separate links to the client (one for the client certificate generation and one for database access)
Any suggestions? I've tried also to do this with apache ssl_error_module with no luck.
Thanks in advance.


server {
listen 8443;
ssl on;
ssl_certificate /etc/httpd/ssl/proxy-ssl.cer;
ssl_certificate_key /etc/httpd/ssl/server.key;
ssl_client_certificate /etc/httpd/ssl/ca-bundle.crt;
ssl_session_timeout 5m;
ssl_protocols SSLv2 SSLv3 TLSv1;
ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
ssl_prefer_server_ciphers on;
ssl_verify_client on;
ssl_verify_depth 5;

error_page 400 /400.html;
location /400.html {
root /usr/share/nginx/html;
}

access_log /var/log/nginx/proxy.access.log main;
error_log /var/log/nginx/proxy.error.log debug;

location / {
proxy_pass http://10.20.0.15:80; proxy_buffering on;
proxy_set_header Subject $ssl_client_s_dn;
proxy_set_header Issuer $ssl_client_i_dn;
proxy_set_header SerialNumber $ssl_client_serial;
client_max_body_size 10m;
client_body_buffer_size 128k;
proxy_connect_timeout 15;
proxy_intercept_errors on;
}
}