SSL client certificate authentication using ruby (Sinatra)

You can nginxuse to take care of client certificates - here is a blog post showing how to set it up:

server {
    listen        443;
    ssl on;
    server_name example.com;

    ssl_certificate      /etc/nginx/certs/server.crt;
    ssl_certificate_key  /etc/nginx/certs/server.key;
    ssl_client_certificate /etc/nginx/certs/ca.crt;
    ssl_verify_client optional;

    location / {
        root           /var/www/example.com/html;
        fastcgi_pass   127.0.0.1:9000;
        fastcgi_param  SCRIPT_FILENAME /var/www/example.com/lib/Request.class.php;
        fastcgi_param  VERIFIED $ssl_client_verify;
        fastcgi_param  DN $ssl_client_s_dn;
        include        fastcgi_params;
    }
}

We specify the server's certificate (server.crt) and private key (server.key). We specify the CA certificate used to sign the client certificate (ca.crt). Set ssl_verify_client to optional. If provided, this tells nginx to try to verify the SSL certificate. My API allows both authenticated and unauthenticated requests, however, if you only want to allow authenticated requests, you can go ahead and set this value to on.

You can use thinwithnginx , but I believe using passengerwithnginx is more popular in this case and easier to deploy.

ssl_verify_client optionalExplained here :

ssl_verify_client

Syntax:   ssl_verify_client on | off | optional | optional_no_ca
Default:  off
Context:   http | server
Reference:    ssl_verify_client

This directive enables client authentication. The parameter "optional" checks the client's identity using its certificate, in case the client is available to the server.