如何为nginx客户端证书验证指定多个根证书？

发布时间：2020-12-13 21:25:27 所属栏目：Nginx 来源：网络整理

导读：对于作为欧洲电网基础设施(EGI)一部分的项目,我们需要对在nginx上运行的服务进行SSL客户端证书验证.由于EGI中允许有几个根CA,我们需要nginx在客户端证书验证期间检查它们. In the documentation of nginx我只能找到参数ssl_client_certificate,它允许只指定

对于作为欧洲电网基础设施(EGI)一部分的项目,我们需要对在nginx上运行的服务进行SSL客户端证书验证.由于EGI中允许有几个根CA,我们需要nginx在客户端证书验证期间检查它们. In the documentation of nginx我只能找到参数ssl_client_certificate,它允许只指定一个包含根证书的文件.

有没有办法在nginx中为客户端证书验证指定多个根CA,还是我必须使用Apache？

最佳答案

Nginx支持多个根证书.只需将多个根CA证书放入ssl_client_certificate指令中指定的文件中即可.注意docs明确说“证书”(复数).

This is a consideration为什么nginx不支持目录中的ssl_client_certificate(就像Apache那样)

“Certificate file” vs “certificate path” difference isn’t about running something after updates of certificates or not (in both cases you have to update something,either cat to a single file or the c_rehash script to create symbolic links in case of CApath). The difference is about certificates in memory vs. certficates on disk,and the later implies syscalls and disk access on each certificate check.

As nginx is designed to work under high loads,with many requests (and handshakes) per second,it uses CAfile variant. And as nginx configuration reload is seamless,it’s unlikely the CApath variant will add any extra value.

Maxim Dounin

（编辑：李大同）

【声明】本站内容均来自网络，其相关言论仅代表作者个人观点，不代表本站立场。若无意侵犯到您的权利，请及时与联系站长删除相关内容!