Home / server / Questions / 359095
Accepted
Vladimir Panteleev
Asked: 2012-02-12 01:53:51 +0800 CST

HTTPS vhost multiplexing with upstream client certificate auth with nginx

  • 772

Let's say I have two Apache servers (one per vhost) behind an nginx server.

The problem is that I'd like Apache to do the authentication of client certificates.

Would it be possible for nginx to do the SNI part of SSL (so it knows to which Apache instance to forward to), and forward the rest to Apache?

ssl nginx https sni

1 Answers

  1. Best Answer

    I don't believe so, since the SSL client as far as Apache's concerned is the nginx server. The nginx proxy can't have the client's private key, so it can't act as the client for authentication purposes when communicating with the Apache servers.

    The device communicating with the client needs to be the one dealing with any client authentication - so this probably isn't feasible.

    • 1