On Mon, Sep 21, 2009 at 08:46:03AM -0400, adileso wrote:

> Hi all,
>
> I have published an internal web site with HTTPS and set the ssl_verify_client on. I need some fields from the client certificate to send them to the back-end web server, so I can correctly access a specific database.
>
> It's working but I also need to redirect the client to a second internal website in case his certificate is missing or is invalid.
> I have tried to capture the error page that I've got in the browser (when I don't send a client certificate) and put a redirect link in that error page. The second website will generate the client certificates based on a user and password.
>
> I am trying to avoid to give 2 separate links to the client (one for the client certificate generation and one for database access)
> Any suggestions? I've tried also to do this with apache ssl_error_module with no luck.
> Thanks in advance.
>
>
> server {
> listen 8443;
> ssl on;
> ssl_certificate /etc/httpd/ssl/proxy-ssl.cer;
> ssl_certificate_key /etc/httpd/ssl/server.key;
> ssl_client_certificate /etc/httpd/ssl/ca-bundle.crt;
> ssl_session_timeout 5m;
> ssl_protocols SSLv2 SSLv3 TLSv1;
> ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
> ssl_prefer_server_ciphers on;
> ssl_verify_client on;
> ssl_verify_depth 5;
>
> error_page 400 /400.html;
> location /400.html {
> root /usr/share/nginx/html;
> }
>
> access_log /var/log/nginx/proxy.access.log main;
> error_log /var/log/nginx/proxy.error.log debug;
>
> location / {
> proxy_pass http://10.20.0.15:80; proxy_buffering on;
> proxy_set_header Subject $ssl_client_s_dn;
> proxy_set_header Issuer $ssl_client_i_dn;
> proxy_set_header SerialNumber $ssl_client_serial;
> client_max_body_size 10m;
> client_body_buffer_size 128k;
> proxy_connect_timeout 15;
> proxy_intercept_errors on;
> }
> }

I do not undernstand your problem completely, however, probably you need
something like this:

error_page 495 = /invalid;
error_page 496 = /no_cert;

location / {
# usual way
proxy_pass ...
}

location = /invalid {
# invalid cert
proxy_pass ...
}

location = /no_cert {
# no cert
proxy_pass ...
}


--
Igor Sysoev
http://sysoev.ru/en/