Nginx: Client certificate authentication works with self-generated certificates, but not with "official" certificates


Archid

After hours or research I finally gave up on this problem and need help. I configured my Nginx server to handle client authentication via certificates, it's as simple as:

First, I used this tutorial to generate my client and server .crt https://fardog.io/blog/2017/12/30/client-side-certificate-authentication-with-nginx/

Then, add these lines to my config.

ssl_client_certificate /etc/nginx/ssl/myCA.crt;
ssl_verify_client on;

Finally, I installed the .pfx on my workstation, ran Internet Explorer, and browsed my website. IE asked me for a certificate and it worked great!

After that, for obvious reasons, I decided to use a real certificate issued by a trusted company. This is a digicert SHA2 secure server CA 's way.

This time I converted .pfx to .crt and .key, I uploaded .crt into Nginx server to replace myCa.crt, then added pfx to my workstation.

Unfortunately this time IE doesn't want to prompt me for a certificate. I tried using Postman but got this message (after adding pfx to settings/certificates): 21: Unable to verify first certificate

My question is, what is the difference between my trusted certificate and my own generated certificate? I don't know why this doesn't work, and I have no other error messages to fall back on.

To be sure, I'm using the same trusted certificate for the client and server, but I tried the same thing with a sefl generated file and it worked.

I have no clue...

Thank you in advance.

Archid

Yes, so after a long troubleshooting session I found out that I had to add the global root certificate to my Ubuntu server's trusted CA store and all chain certificates to the server side .crt file.

Thank you.

Related


Nginx client authentication using multiple client certificates

Jonathan Nagin I'm trying to setup NGINX to perform client authentication for multiple clients. My problem is that those clients will have different certificates, basically different root CAs: [clientA.crt] ClientA > IntermediateA > RootA [clientB.crt] ClientB

Nginx client authentication using multiple client certificates

Jonathan Nagin I'm trying to setup NGINX to perform client authentication for multiple clients. My problem is that those clients will have different certificates, basically different root CAs: [clientA.crt] ClientA > IntermediateA > RootA [clientB.crt] ClientB

Nginx client authentication using multiple client certificates

Jonathan Nagin I'm trying to setup NGINX to perform client authentication for multiple clients. My problem is that those clients will have different certificates, basically different root CAs: [clientA.crt] ClientA > IntermediateA > RootA [clientB.crt] ClientB

WSDL client authentication and multiple certificates

other: So I'm having issues with wsdls here, with multiple certificates selected in Java. For example, a smart card has multiple certificates on it for signing, encryption and identification. I have a WSDL that generates code for client auth connections, but a

WSDL client authentication and multiple certificates

other: So I'm having issues with wsdls here, with multiple certificates selected in Java. For example, a smart card has multiple certificates on it for signing, encryption and identification. I have a WSDL that generates code for client auth connections, but a

WSDL client authentication and multiple certificates

other: So I'm having issues with wsdls here, with multiple certificates selected in Java. For example, a smart card has multiple certificates on it for signing, encryption and identification. I have a WSDL that generates code for client auth connections, but a

How to allow specific SSL client certificates in Nginx?

Joe White Nginx ssl_client_certificateand ssl_trusted_certificatedirectives can be used to allow client certificates signed by a given authority. But how to allow specific certificates? I want to filter by certificate thumbprint or by certificate authority + c