Welcome! Log In Create A New Profile

Advanced

Re: Validate Client certificate SDN fields (CN, OU, O, etc..) at Nginx

Francis Daly
November 27, 2014 03:12AM
On Wed, Nov 26, 2014 at 11:24:45AM -0500, sandeepkolla99 wrote:

Hi there,

> I'm able to verify client certificate successfully. Now, additionally I want
> perform the following three validations on client certificate

You have $ssl_client_s_dn.

If you want to stay purely in nginx.conf, can you use "map" or another
regex match to extract the parts that you want into whatever variables
you want?

If you intend to use some backend processor (proxy_pass, fastcgi_pass),
then potentially you could send the variables or the certificate there
for validation.

Of you could use one of the embedded languages to access the same
variables.

I am not aware that stock nginx auto-creates extra variables beyond those
which are in the documentation -- if you want more, you do it yourself.

> I'm trying to find the nginx configuration statements to implement these
> validations. Please let me know if I need to elaborate this further.

Use "if" to compare (bits of) $ssl_client_s_dn with the thing you want,
and act accordingly.

f
--
Francis Daly francis@daoine.org

_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx
Subject Author Posted

Validate Client certificate SDN fields (CN, OU, O, etc..) at Nginx

sandeepkolla99 November 25, 2014 10:19AM

Re: Validate Client certificate SDN fields (CN, OU, O, etc..) at Nginx

Francis Daly November 25, 2014 03:46PM

Re: Validate Client certificate SDN fields (CN, OU, O, etc..) at Nginx

sandeepkolla99 November 26, 2014 11:24AM

Re: Validate Client certificate SDN fields (CN, OU, O, etc..) at Nginx

Francis Daly November 27, 2014 03:12AM



Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 361
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready