I'm running
nginx -V
nginx version: nginx/1.19.0 (pgnd Build)
built with OpenSSL 1.1.1g 21 Apr 2020
TLS SNI support enabled
...
It serves as front-end SSL termination, site host, and reverse-proxy to backend
apps.
I'm trying to get a backend app to proxy_ssl_verify the proxy connection to it.
I have two self-signed certs:
One for "TLS Web Client Authentication, E-mail Protection"
openssl x509 -in test.example.com.client.crt -text | egrep
"Subject.*CN|DNS|TLS"
Subject: C = US, ST = NY, L = New_York, O = example2.com, OU =
myCA, CN = test.example.com, emailAddress = s...@example2.com
TLS Web Client Authentication, E-mail Protection
DNS:test.example.com, DNS:www.test.example.com,
DNS:localhost
and the other, for "TLS Web Server Authentication"
openssl x509 -in test.example.com.server.crt -text | egrep
"Subject.*CN|DNS|TLS"
Subject: C = US, ST = NY, L = New_York, O = example2.com, OU =
myCA, CN = test.example.com, emailAddress = s...@example2.com
TLS Web Server Authentication
DNS:test.example.com, DNS:www.test.example.com,
DNS:localhost
The certs 'match' CN & SAN, differing in "X509v3 Extended Key Usage".
Both are verified "OK" with my local CA cert
openssl verify -CAfile myCA.crt.pem test.example.com.server.crt
test.example.com.server.crt: OK
openssl verify -CAfile /myCA.crt.pem test.example.com.client.crt
test.example.com.client.crt: OK
My main nginx config includes,
upstream test.example.com {
server test.example.com:11111;
}
server {
listen 10.10.10.1:443 ssl http2;
server_name example.com;
...
ssl_verify_client on;
ssl_client_certificate "/etc/ssl/nginx/myCA.crt";
ssl_verify_depth 2;
ssl_certificate "/etc/ssl/nginx/example.com.server.crt";
ssl_certificate_key "/etc/ssl/nginx/example.com.server.key";
ssl_trusted_certificate "/etc/ssl/nginx/myCA.crt";
location /app1 {
proxy_pass https://test.example.com;
proxy_ssl_certificate
"/etc/ssl/nginx/test.example.com.client.crt";
proxy_ssl_certificate_key
"/etc/ssl/nginx/test.example.com.client.key";
proxy_ssl_trusted_certificate "/etc/ssl/nginx/myCA.crt";
proxy_ssl_verify on;
proxy_ssl_verify_depth 2;
include includes/reverse-proxy.inc;
}
}
and the upstream config,
server {
listen 127.0.0.1:11111 ssl http2;
server_name test.example.com;
root /data/webapps/demo_app/;
index index.php;
expires -1;
ssl_certificate
"/etc/ssl/nginx/test.example.com.server.crt";
ssl_certificate_key
"/etc/ssl/nginx/test.example.com.server.key";
ssl_client_certificate "/etc/ssl/nginx/myCA.crt";
ssl_verify_client optional;
ssl_verify_depth 2;
location ~ \.php {
try_files $uri =404;
fastcgi_pass phpfpm;
fastcgi_index index.php;
fastcgi_param PATH_INFO $fastcgi_script_name;
include fastcgi_params;
}
}
access to
https://example.com/app1
responds,
502 Bad Gateway
logs, show an SSL handshake fail
...
2020/05/29 19:00:06 [debug] 29419#29419: *7 SSL: TLSv1.3, cipher:
"TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any Au=any Enc=CHACHA20/POLY1305(256)
Mac=AEAD"
2020/05/29 19:00:06 [debug] 29419#29419: *7 http upstream ssl
handshake: "/app1/?"
2020/05/29 19:00:06 [debug] 29419#29419: *7 X509_check_host(): no match
2020/05/29 19:00:06 [error] 29419#29419: *7 upstream SSL certificate
does not match "test.example.com" while SSL handshaking to upstream, client:
10.10.10.73, server: example.com, request: "GET /app1/ HTTP/2.0", upstream:
"https://127.0.0.1:11111/app1/";, host: "example.com"
2020/05/29 19:00:06 [debug] 29419#29419: *7 http next upstream, 2
...
If I toggle
- ssl_verify_client on;
+ ssl_verify_client off;
then I'm able to connect to the backend site, as expected.
What exactly is NOT matching in the handshake? CN & SAN do ...
&/or, is there a config problem above?
_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx
