这是情况 – 有一个透明的Nginx代理处理SSL证书,并且在我们决定添加撤销列表管理之前做得很好,出于安全原因需要.这是“ssl_crl”行开始播放并搞砸所有内容的时候.
server {
listen 80;
rewrite ^ https://$host$request_uri permanent;
}
server {
listen 443 ssl;
server_name example.com;
ssl on;
ssl_certificate /home/netadmin/keys/tid.crt;
ssl_certificate_key /home/netadmin/keys/tid.key;
ssl_session_cache shared:SSL:10m;
ssl_client_certificate /home/netadmin/keys/personchain.pem;
ssl_crl /home/netadmin/keys/personlist.crl;
ssl_verify_client on;
ssl_verify_depth 2;
error_log /var/log/Nginx/debug.log debug;
location / {
proxy_pass http://111.111.111.111:80;
}
每当用户尝试使用SSL进行身份验证时,服务器将始终提供“400 Bad Request”错误.
请注意,完全相似(因为语法不同)配置在Apache中完美运行.
现在证书是完美的,已经多次证明,例如这里的验证检查
openssl crl -CAfile personchain.pem -inform PEM -in personlist.crl -lastupdate -nextupdate -noout verify OK lastUpdate=Apr 22 14:59:18 2013 GMT nextUpdate=Apr 29 14:59:18 2013 GMT
2013/04/23 15:47:42 [info] 3612#0: *1 client SSL certificate verify error: (3:unable to get certificate CRL) while reading client request headers,client: 192.168.122.1,server: example.com,request: "GET / HTTP/1.1",host: "example.com"
这基本上是唯一的错误,正如我之前所说,相同的证书可以与Apache一起使用.
我认为这可能是一个错误,但类似错误的最后一个通知是2011年,所以我怀疑还没有人解决这个难题.
解决方法@H_403_19@
答案如下：
https://serverfault.com/a/676498/277052：
如果您有多个CA,则必须连接所有CRL.
You have to concatenate all the CRL in chain: Root CA and Intermediate CAs.
Using openssl crl -in crl_list.crl -noout -text only read the first crl,but Nginx reads them correctly and validate the user certificate.
Inspired by: 07001
如果您有多个CA,则必须连接所有CRL.
You have to concatenate all the CRL in chain: Root CA and Intermediate CAs.
Using
openssl crl -in crl_list.crl -noout -textonly read the first crl,but Nginx reads them correctly and validate the user certificate.Inspired by: 07001
