SSL client certificates and PHP: nginx compatibility with Apache information

Scorpio

I have a PHP login module based on SSL client certificates. It works fine with Apache. Now I'm trying to figure out how to port this to nginx.

With Apache, the contents of the certificate can be very conveniently accessed using a number of environment variable sets. The email address will be in $_SERVER['SSL_CLIENT_S_DN_Email']eg.

I found out that it $ssl_client_s_dnis possible to pass nginx variables to PHP fastcgi_param. However, I will get the whole DNstring.

  • Do I need to parse the provided DNstring myself or is there a better way?
  • If it has to be parsed, which specification can be used to get the correct format?
  • Does Nginx serve the same strings as Apache SSL_CLIENT_S_DN?
Scorpio

Nginx uses OpenSSL X509_NAME_oneline()functions to generate strings. The documentation for this function states the following:

functions X509_NAME_oneline()and X509_NAME_print()are legacy functions that produce non-standard forms of output, they don't handle multi-character fields, and have all kinds of quirks and inconsistencies. Their use is strongly discouraged in new applications.

Apache 2.2 uses the same functionality SSL_CLIENT_S_DN. As of version 2.3.11, Apache HTTPD uses an RFC 2253 compliant format by default .

So to answer my own question:

  • Do I have to parse the provided DN string myself, or is there a better way?

    This $ssl_client_s_dnvariable is the only information provided by nginx. Alternatively, raw certificate data can also be used. However, this can cause performance issues as nginx has to copy the entire certificate for each call.

  • If it has to be parsed, which specification can be used to get the correct format?

    The format of the string is truthful X509_NAME_oneline(). The parsing of this string doesn't seem to be done bulletproof.

  • Does Nginx serve the same strings as Apache SSL_CLIENT_S_DN?

    Apache will use it in versions prior to 2.3.11, and by default later versions use the RFC 2253 format. However, they can be configured to use the old format.

Related

How to allow specific SSL client certificates in Nginx?

Joe White Nginx ssl_client_certificateand ssl_trusted_certificatedirectives can be used to allow client certificates signed by a given authority. But how to allow specific certificates? I want to filter by certificate thumbprint or by certificate authority + c

NGINX uses client certificates (ssl_verify_client)

TDawg I have a weird question, I don't even know how to phrase it, but I tried my best I use laravel forge to manage my SSL via LetsEncrypt. It generates the file: server.crt server.key How to get .pem files from .key and .crt files? Based on that link, I u

Nginx and SSL certificates

Lesha Ppiev I want to provide ssl support for my website under Nginx. First, I tried to use a self-signed certificate, but as you know, the browser complains The current connection cannot be trusted Second, I tried ordering a free certificate from a reputable

Nginx and SSL certificates

Lesha Ppiev I want to provide ssl support for my website under Nginx. First, I tried to use a self-signed certificate, but as you know, the browser complains The current connection cannot be trusted Second, I tried ordering a free certificate from a reputable

Nginx client authentication using multiple client certificates

Jonathan Nagin I'm trying to setup NGINX to perform client authentication for multiple clients. My problem is that those clients will have different certificates, basically different root CAs: [clientA.crt] ClientA > IntermediateA > RootA [clientB.crt] ClientB

Nginx client authentication using multiple client certificates

Jonathan Nagin I'm trying to setup NGINX to perform client authentication for multiple clients. My problem is that those clients will have different certificates, basically different root CAs: [clientA.crt] ClientA > IntermediateA > RootA [clientB.crt] ClientB

Nginx client authentication using multiple client certificates

Jonathan Nagin I'm trying to setup NGINX to perform client authentication for multiple clients. My problem is that those clients will have different certificates, basically different root CAs: [clientA.crt] ClientA > IntermediateA > RootA [clientB.crt] ClientB

Google manages SSL certificates with Nginx Ingress

Eric So I'm setting up multiple GKE clusters and can only use wildcard domain certificates, but my domain is two levels deep so it doesn't work. So now I'm trying to use managed Google hosted certificates, but it seems to only work with GCE ingress, not nginx.

Google manages SSL certificates with Nginx Ingress

Eric So I'm setting up multiple GKE clusters and can only use wildcard domain certificates, but my domain is two levels deep so it doesn't work. So now I'm trying to use managed Google hosted certificates, but it seems to only work with GCE ingress, not nginx.

Google manages SSL certificates with Nginx Ingress

Eric So I'm setting up multiple GKE clusters and can only use wildcard domain certificates, but my domain is two levels deep so it doesn't work. So now I'm trying to use managed Google hosted certificates, but it seems to only work with GCE ingress, not nginx.

Google manages SSL certificates with Nginx Ingress

Eric So I'm setting up multiple GKE clusters and can only use wildcard domain certificates, but my domain is two levels deep so it doesn't work. So now I'm trying to use managed Google hosted certificates, but it seems to only work with GCE ingress, not nginx.

Disable SSL client certificates on *some* WebAPI controllers?

Deep Space 101 Edit for future readers : Unfortunately, the bounty awarded answer doesn't work;there's nothing I can do about it right now. But please read my own answer below (by testing) - confirmed to work with minimal code changes We have an Azure cloud se

Disable SSL client certificates on *some* WebAPI controllers?

Deep Space 101 Edit for future readers : Unfortunately, the bounty awarded answer doesn't work;there's nothing I can do about it right now. But please read my own answer below (by testing) - confirmed to work with minimal code changes We have an Azure cloud se

Disable SSL client certificates on *some* WebAPI controllers?

Deep Space 101 Edit for future readers : Unfortunately, the bounty awarded answer doesn't work;there's nothing I can do about it right now. But please read my own answer below (by testing) - confirmed to work with minimal code changes We have an Azure cloud se

Client-Side SSL with Intermediate Certificates

Naftuli Kay I have a self signed root certificate and an intermediate certificate signed by that root. Basically something like this: . └── master (CA) └── servant1 (CA) I have some client certificates from master->servant1certificate chain : . └── master

Disable SSL client certificates on *some* WebAPI controllers?

Deep Space 101 Edit for future readers : Unfortunately, the bounty awarded answer doesn't work;there's nothing I can do about it right now. But please read my own answer below (by testing) - confirmed to work with minimal code changes We have an Azure cloud se

Disable SSL client certificates on *some* WebAPI controllers?

Deep Space 101 Edit for future readers : Unfortunately, the bounty awarded answer doesn't work;there's nothing I can do about it right now. But please read my own answer below (by testing) - confirmed to work with minimal code changes We have an Azure cloud se

Client-Side SSL with Intermediate Certificates

Naftuli Kay I have a self signed root certificate and an intermediate certificate signed by that root. Basically something like this: . └── master (CA) └── servant1 (CA) I have some client certificates from master->servant1certificate chain : . └── master

How to handle invalid SSL certificates with Apache HttpClient?

Rauch: I know, there are many different questions and many answers about this...but I don't get it... I have: installed ubuntu-9.10-desktop-amd64 + NetBeans6.7.1 "as is" from shutdown. Represents that I need to connect to a site via HTTPS. For this I use Apach

Ignore SSL certificates in Apache HttpClient 4.3

Jakub M .： How to ignore SSL certificate (trust all) for Apache HttpClient 4.3 ? All the answers I've found on SO treat previous versions and the API has changed. related: How to ignore SSL certificate errors in Apache HttpClient 4.0 How to handle invalid SSL

Ignore SSL certificates in Apache HttpClient 4.3

Jacob M. How to ignore SSL certificate (trust all) for Apache HttpClient 4.3 ? All the answers I've found on SO treat previous versions and the API has changed. related: How to ignore SSL certificate errors in Apache HttpClient 4.0 How to handle invalid SSL ce