Welcome! Log In Create A New Profile

Advanced

Re: Need to compare client certificate CN with an entry in /etc/hosts

Francis Daly
November 26, 2013 06:16PM
On Tue, Nov 26, 2013 at 07:19:55PM +0000, Radha Venkatesh (radvenka) wrote:

Hi there,

> An additional requirement is that we have to match the client certificate
> CN with an existing entry in /etc/hosts. What would be the simplest
> mechanism to do this? HttpPerlModule? Uwsgi?

In nginx terms, you have $remote_addr as the client IP address, and you
have the variables described in

http://nginx.org/en/docs/http/ngx_http_ssl_module.html#variables

as "things from the certificate".

I don't see CN listed there, so I suspect that whatever you do is going
to involve some extra parsing of the certificate, which probably means
something external or dynamic within nginx.conf.

The "simplest" mechanism is probably whichever one you are most familiar
with already.

Whether you use an embedded language or something external, you can make
sure to send the appropriate raw information to it, and let it decide
whether this is good or not.

You may be interested in trying http://nginx.org/r/auth_request as one
possibly way of communicating the success or failure state of your check
back to nginx, but it all depends on the extra code that you must write.

Good luck with it,

f
--
Francis Daly francis@daoine.org

_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx
Subject Author Posted

Need to compare client certificate CN with an entry in /etc/hosts

Radha Venkatesh (radvenka) November 26, 2013 02:22PM

Re: Need to compare client certificate CN with an entry in /etc/hosts

Jonathan Matthews November 26, 2013 02:56PM

RE: Need to compare client certificate CN with an entry in /etc/hosts

Radha Venkatesh (radvenka) November 26, 2013 05:50PM

RE: Need to compare client certificate CN with an entry in /etc/hosts

GreenGecko November 26, 2013 05:56PM

Re: Need to compare client certificate CN with an entry in /etc/hosts

Jonathan Matthews November 26, 2013 06:02PM

Re: Need to compare client certificate CN with an entry in /etc/hosts

Francis Daly November 26, 2013 06:16PM

RE: Need to compare client certificate CN with an entry in /etc/hosts

Radha Venkatesh (radvenka) November 26, 2013 07:02PM

Re: Need to compare client certificate CN with an entry in /etc/hosts

Francis Daly November 27, 2013 06:08PM



Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 100
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready