On Tue, Sep 22, 2009 at 05:45:27AM -0400, adileso wrote:

> Thank you very much Igor,
>
> Your setup is working fine if I do reverse proxy on http.
> Because I needed to redirect the error to a https page, I have modified the setup by creating another proxy ssl instance, where I didn't asked for ssl_verify_client.

You do not need an external redirect for this:

error_page 495 496 /certsrv;

location = /certsrv {
proxy_pass https://internal.web.server;
...
}

> My setup is working now, even if I don't use the standard SSL port. Any other suggestions for it?
> Here it is, for any other interested:
>
>
>
> # HTTPS server configuration
> #
>
> server {
> listen 443;
>
> ssl on;
> ssl_certificate /etc/httpd/ssl/proxy-ssl.cer;
> ssl_certificate_key /etc/httpd/ssl/server.key;
> ssl_client_certificate /etc/httpd/ssl/ca-bundle.crt;
> ssl_session_timeout 5m;
> ssl_protocols SSLv2 SSLv3 TLSv1;
> ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
> ssl_prefer_server_ciphers on;
> ssl_verify_client on;
> ssl_verify_depth 5;
>
>
> error_page 495 https://external.web.address:44399/certsrv;
> error_page 496 https://external.web.address:44399/certsrv;
>
> location / {
> proxy_pass http://internal.web.server:80; proxy_buffering on;
> proxy_set_header Subject $ssl_client_s_dn;
> proxy_set_header Issuer $ssl_client_i_dn;
> proxy_set_header SerialNumber $ssl_client_serial;
> client_max_body_size 10m;
> client_body_buffer_size 128k;
> proxy_connect_timeout 15;
> proxy_intercept_errors on;
> }
>
> access_log /var/log/nginx/proxy.access.log main;
> error_log /var/log/nginx/proxy.error.log debug;
>
> }
>
>
> server {
> listen 44399;
>
> ssl on;
> ssl_certificate /etc/httpd/ssl/proxy-ssl.cer;
> ssl_certificate_key /etc/httpd/ssl/server.key;
> ssl_session_timeout 5m;
> ssl_protocols SSLv2 SSLv3 TLSv1;
> ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
> ssl_prefer_server_ciphers on;
>
> location / {
> proxy_pass https://internal.web.server; proxy_buffering on;
> client_max_body_size 10m;
> client_body_buffer_size 128k;
> proxy_connect_timeout 15;
> proxy_intercept_errors on;
> }
>
> access_log /var/log/nginx/certificate.access.log main;
> error_log /var/log/nginx/certificate.error.log debug;
>
> }
>
> Posted at Nginx Forum: http://forum.nginx.org/read.php?2,8120,8343#msg-8343
>

--
Igor Sysoev
http://sysoev.ru/en/