如何代理http_x_ssl_client_s

@H_404_1@我想通过Nginx代理请求标头’HTTP_X_SSL_CLIENT_S_DN’.

@H_404_1@这是我们的服务器网络结构.

@H_404_1@

[front server:443] <---> [Nginx proxy:8004] <---> [application server:8008]
(client cert auth)

@H_404_1@当我尝试两台服务器([前端服务器]和[应用服务器])时,它运行正常.标题“HTTP_X_SSL_CLIENT_S_DN”已传递给应用程序服务器.

@H_404_1@然后添加服务器[Nginx proxy],标题’HTTP_X_SSL_CLIENT_S_DN’未传递给应用程序服务器.

@H_404_1@我的Nginx配置如下.

@H_404_1@

server {
    listen   8004;
    index index.html;

    location / {
        proxy_pass_header Server;
        proxy_pass_header X-Scheme;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_pass http://app-server/;

# TODO: to proxy 'HTTP_X_SSL_CLIENT_S_DN'
# Failed settings
#        proxy_pass_request_headers on; # not worked (default: on)
#        proxy_pass_header X-SSL-Client-S-DN; # none
#        proxy_pass_header X_SSL_CLIENT_S_DN; # none
#        proxy_pass_header HTTP_X_SSL_CLIENT_S_DN; # none
#        proxy_pass_header HTTP-X-SSL-CLIENT-S-DN; # none
#        proxy_set_header X-SSL-Client-S-DN $ssl_client_s_dn; # none
#        proxy_set_header X_SSL_Client_S_DN $x_ssl_client_s_dn; # none
#        proxy_set_header X-SSL-Client-S-DN $http_ssl_client_s_dn; # none
#        proxy_set_header X-SSL-Client-S-DN $http_x_ssl_client_s_dn; # none
    }
}

upstream app-server {
    server 127.0.0.1:8008;
}

@H_404_1@任何帮助申请.

最佳答案

首先,请确保已配置Nginx.conf来验证客户端证书！我有完全相同的问题你描述.

@H_404_1@

server {
  # ...
  ssl_client_certificate /srv/ssl/self.crt;
  ssl_verify_depth     1;
  ssl_verify_client    on;
  # ...
  location @app { # I'm using Nginx+unicorn,don't blindly copy this!  :)
    # ...
    proxy_set_header X-SSL-Client-Serial $ssl_client_serial;
    proxy_set_header X-SSL-Client-Verify $ssl_client_verify;
    proxy_set_header X-SSL-Client-S-DN   $ssl_client_s_dn;
    # ...
}

@H_404_1@要对此进行测试,您需要一个单独的客户端密钥和使用根授权证书签名的证书.客户端凭据以“me”开头,我的根权限凭据在以下命令中以“self”开头.

@H_404_1@>为客户端生成私钥.

@H_404_1@

openssl genrsa -out me.key 1024

@H_404_1@>请求自我CA签名.

@H_404_1@

openssl req -new -key me.key -out me.csr

@H_404_1@>使用自CA签署请求以创建证书.

@H_404_1@

openssl x509 -req -days 365 -in me.csr -CA self.crt -CAkey self.key -set_serial 01 -out me.crt

@H_404_1@>试试你的新钥匙.

@H_404_1@

curl -v -s -k --key me.key --cert me.crt https://fort-awesome-o

@H_404_1@>额外信用：生成可导入浏览器的证书.

@H_404_1@

openssl pkcs12 -export -in me.crt -inkey me.key -certfile self.crt -out me.p12

@H_404_1@我有一个简单的Sinatra Web应用程序转储HTTP环境,我看到以下内容：

@H_404_1@“HTTP_X_SSL_CLIENT_SERIAL”=>“01”,“HTTP_X_SSL_CLIENT_VERIFY”=>“SUCCESS”,“HTTP_X_SSL_CLIENT_S_DN”=>“/ C = US / ST = Maryland / L = Annapolis / O = Fort Kickass / CN = Jonathan Morton / emailAddress=jon@jonmorton.com”

如何代理http_x_ssl_client_s_dn标题？

猜你在找的Nginx相关文章