Nginx client authentication using multiple client certificates

The http://nginx.org/r/ssl_client_certificate directive is used to specify a certificate to trust for client-based authentication. Note that basically every time you try to connect, the whole list is sent ( if you don't need it, use ssl_trusted_certificateit as per the documentation ).

As mentioned above, note that ssl_verify_depthyou can basically control how easy it is to get into the system - if you set it to a high enough value and someone is able to get a certificate through a CA you trust or through a CA. An intermediary they trust generates their own certificate, then they can authenticate to your nginx whether you want to or not.

Therefore, it is common practice that all certificates used for client-based authentication are generated by privately recognized CAs, so in general, the length of the chain should not be too large. If you want to equalize the number of depths between two CAs so you get the best protection out of them ssl_verify_depth, you can think of creating an extra CA to add to the depth, and then adding that CA to the trusted list instead of the actual intermediary now . (Note that once some intermediaries are involved, it gets complicated, the browser will need to be aware of their existence, usually cache them, and can cause many ghosting issues when not cached.)

Also, note that you don't actually have to have only one CA in the specified file, it can contain multiple unrelated "root" CAs, so if you're adding multiple independent CAs, you don't really have to bother creating another CA Authenticate it - you can include such an independent CA as is.