Hi @HollyGhos,

I would opt for "placing the cert and crl-file at the right place and all the magic is done automatically". Appropriate filenames could be used to dynamically create the proxy configuration. The following is what I'm currently using and it could be used a base template to generate the needed configuration stanzas:

upstream www.example.com {                                        
    server 192.168.0.1:8080;                                                    
}                                                                               
                                                                                
server {                                                                        
    server_name www.example.com;                                  
    return 301 https://$host$request_uri;                                       
}                                                                               
                                                                                
server {                                                                        
    server_name www.example.com;                                  
    listen 443 ssl;                                                             
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;                                        
    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AE
S128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';    ssl_prefer_server_ciphers on;                                               
    ssl_session_timeout 5m;                                                     
    ssl_session_cache shared:SSL:50m;                                           
    ssl_certificate /etc/nginx/certs/www.example.com.crt;                          
    ssl_certificate_key /etc/nginx/certs/www.example.com.key;                      
    ssl_dhparam /etc/nginx/certs/www.example.com.dhparams.pem;                     
    ssl_crl /etc/nginx/certs/ca.example.com.crl;                                  
    ssl_client_certificate /etc/nginx/certs/ca.example.com.crt;                
    ssl_verify_client on;                                                       
    add_header Strict-Transport-Security "max-age=31536000";                    
    location / {                                                                
        proxy_pass http://www.example.com;                        
    }                                                                           
}

SSL Client Authentication Support (ssl_crl, ssl_verify_client) #278

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions