Peteris's questions

I'm having trouble determining why Firefox is not applying client certificate authentification in a particular situation.

I have a self-signed client certificate issued for a specific site (nginx mutual TLS) that works when accessing the site using Chrome and when testing with curl, and the same certificate in .p12 format is imported in Firefox Certificate Manager / Your Certificates; however, Firefox simply gets refused authentification by the site as it does not send the certificate, does not prompt for anything, does not show any errors and does not show any log or comments about the process, at least not where I could find - for example, the Firefox Network tab Security section shows information about the LetsEncrypt server certificate, but nothing about the client certificate request.

Is there some reasonable way to debug the client certificate authentification process in Firefox to review what is happening during the TLS handshake and analyse the problem? The preferences section in Firefox does not seem to have any relevant options other than the certificate manager.

I have configured nginx as a reverse proxy for a TCP (non-http) stream. I'd like to apply different routing for a particular source IP address - can this be done, and how? I'm aware of recomendations for the http module using the if directive, but that doesn't seem to work for these streams.

Existing configuration:

stream {
  server {
    listen 8000;
    proxy_pass staging;
  }
}

upstream staging {
    server 1.2.3.4:8000;
}

Desired configuration (not working):

stream {
  server {
    listen 8000;
    proxy_pass staging1;
    if ( $remote_addr ~* 4.5.6.7 ) {
        proxy_pass staging2;
    }
  }
}

upstream staging1 {
    server 1.2.3.4:8000;
}
upstream staging2 {
    server 1.2.3.44:8000;
}

This gives error '24314#24314: "if" directive is not allowed here', since it doesn't apply for the stream module - is there any other functionality how I could achieve a similar result?