Client-Side SSL with Intermediate Certificates


Naftuli Kay

I have a self signed root certificate and an intermediate certificate signed by that root. Basically something like this:

.
└── master (CA)
    └── servant1 (CA)

I have some client certificates from master->servant1certificate chain :

.
└── master (CA)
    └── servant1 (CA)
        ├── client1
        ├── client2
        └── client3

I'm trying to authenticate these client certificates in nginx and I'm having trouble doing so.

Here is my nginx configuration:

upstream luci {
    server localhost:8080;
}

server {
    listen                  127.0.0.1:80;
    server_name             myserver;

    return 301 https://$host$request_uri;
}

server {
    listen                  127.0.0.1:443;
    server_name             myserver;

    ssl                     on;
    ssl_certificate         /etc/nginx/certs/myserver.crt;
    ssl_certificate_key     /etc/nginx/certs/myserver.key;

    ssl_session_timeout 5m;

    ssl_prefer_server_ciphers on;
    ssl_protocols TLSv1.2 TLSv1.1;
    ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AES:!ECDH+3DES:!DH+3DES:!RSA+3DES:!aNULL:!MD5:!DSS;

    ssl_client_certificate /etc/nginx/certs/servant1-ca-chain.crt;
    ssl_verify_client on;
    ssl_verify_depth 2;

    location / {
        proxy_pass http://luci;
    }
}

This should be simple. All client certificates signed by intermediate CAs servant1should be allowed to connect to nginx.

However, when I try to access the server with these client certificates, I get the following:

A sort of

(obviously a very detailed and useful bug)

I found this in the log:

2013/12/01 22:46:18 [alert] 7478#0: *5 ignoring stale global SSL error (SSL: error:0407006A:lib(4):func(112):reason(106) error:04067072:lib(4):func(103):reason(114) error:0D0C5006:lib(13):func(197):reason(6)) while reading client request line, client: 192.168.1.208, server: myserver

Useful information is:

Ignore outdated global SSL errors

What's wrong and how can I fix it?

Naftuli Kay

I've generated the certificate using OpenSSL and most likely screwed something up in the process.

My suggestion is to use XCA to generate SSL certificates whenever possible, as it is very secure, fully functional, and easy to manage public and private keys, certificates, CSRs, etc.

Related


Client-Side SSL with Intermediate Certificates

Naftuli Kay I have a self signed root certificate and an intermediate certificate signed by that root. Basically something like this: . └── master (CA) └── servant1 (CA) I have some client certificates from master->servant1certificate chain : . └── master

How secure are client-side SSL certificates in mobile apps?

Jacob Marble I want to have secure communication between my Android/iOS app and my internet access backend service, so I'm looking into HTTPS/SSL. If I create a self-signed certificate, then put the client certificate into the application, and have the backend

How secure are client-side SSL certificates in mobile apps?

Jacob Marble I want to have secure communication between my Android/iOS app and my internet access backend service, so I'm looking into HTTPS/SSL. If I create a self-signed certificate, then put the client certificate into the application, and have the backend

How secure are client-side SSL certificates in mobile apps?

Jacob Marble I want to have secure communication between my Android/iOS app and my internet access backend service, so I'm looking into HTTPS/SSL. If I create a self-signed certificate, then put the client certificate into the application, and have the backend

Heroku SSL: Install intermediate certificates?

Paul Sanwald My registrar gandi gave me the intermediate certificate to install, so I have 3 files: Private key file (server.key) Certificate file (mycert.crt) Intermediate Certificate (GandiSomething.pem) I am using SSL Beta service on heroku . heroku CLI her

Heroku SSL: Install intermediate certificates?

Paul Sanwald My registrar gandi gave me the intermediate certificate to install, so I have 3 files: Private key file (server.key) Certificate file (mycert.crt) Intermediate Certificate (GandiSomething.pem) I am using SSL Beta service on heroku . heroku CLI her

Python SSL server serving intermediate CA certificates

light I'm writing some server code using the Python (2.7) SSL module as follows: ssock = ssl.wrap_socket(sock, ca_certs="all-ca.crt", keyfile="server.key", certfile="server.crt", server_side=True, ssl_version=ssl.PROTOCOL_TLSv1) 'all-ca.crt' contains the signi

Python SSL server serving intermediate CA certificates

light I'm writing some server code using the Python (2.7) SSL module as follows: ssock = ssl.wrap_socket(sock, ca_certs="all-ca.crt", keyfile="server.key", certfile="server.crt", server_side=True, ssl_version=ssl.PROTOCOL_TLSv1) 'all-ca.crt' contains the signi

Disable SSL client certificates on *some* WebAPI controllers?

Deep Space 101 Edit for future readers : Unfortunately, the bounty awarded answer doesn't work;there's nothing I can do about it right now. But please read my own answer below (by testing) - confirmed to work with minimal code changes We have an Azure cloud se

Disable SSL client certificates on *some* WebAPI controllers?

Deep Space 101 Edit for future readers : Unfortunately, the bounty awarded answer doesn't work;there's nothing I can do about it right now. But please read my own answer below (by testing) - confirmed to work with minimal code changes We have an Azure cloud se

Disable SSL client certificates on *some* WebAPI controllers?

Deep Space 101 Edit for future readers : Unfortunately, the bounty awarded answer doesn't work;there's nothing I can do about it right now. But please read my own answer below (by testing) - confirmed to work with minimal code changes We have an Azure cloud se

Disable SSL client certificates on *some* WebAPI controllers?

Deep Space 101 Edit for future readers : Unfortunately, the bounty awarded answer doesn't work;there's nothing I can do about it right now. But please read my own answer below (by testing) - confirmed to work with minimal code changes We have an Azure cloud se

Disable SSL client certificates on *some* WebAPI controllers?

Deep Space 101 Edit for future readers : Unfortunately, the bounty awarded answer doesn't work;there's nothing I can do about it right now. But please read my own answer below (by testing) - confirmed to work with minimal code changes We have an Azure cloud se

How to allow specific SSL client certificates in Nginx?

Joe White Nginx ssl_client_certificateand ssl_trusted_certificatedirectives can be used to allow client certificates signed by a given authority. But how to allow specific certificates? I want to filter by certificate thumbprint or by certificate authority + c

NGINX uses client certificates (ssl_verify_client)

TDawg I have a weird question, I don't even know how to phrase it, but I tried my best I use laravel forge to manage my SSL via LetsEncrypt. It generates the file: server.crt server.key How to get .pem files from .key and .crt files? Based on that link, I u

Install intermediate CA certificates

Harvey I have a Kubernetes cluster hosting my own docker registry built with the following docs : https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/registry and https://github.com/kubernetes/kubernetes /blob/master/cluster/addons/registry/tls

Are intermediate certificates cached in Firefox?

Kit Sunde If someone visits Site A with a GoDaddy-issued certificate that also provides an intermediate certificate between GoDaddy and its CA, then Firefox will cache that intermediate certificate and compare it with a site that also has a GoDaddy-issued cert

Are intermediate certificates cached in Firefox?

Kit Sunde If someone visits Site A with a GoDaddy-issued certificate that also provides an intermediate certificate between GoDaddy and its CA, then Firefox will cache that intermediate certificate and compare it with a site that also has a GoDaddy-issued cert

Ignore self-signed SSL certificates with Jersey client

Chris Salij: I am using Jersey client library to run tests against a rest service running on jboss. I have https setup fine on the server (running on localhost) with a self-signed certificate. However, whenever I run the test with the https url, I get the foll