50

I am trying to enable client certificate authentication in nginx where the certificates have been signed by an intermediate CA. I am able to get this working fine when using a certificate signed by a self-signed root CA; however, this does not work when the signing CA is an intermediate CA.

My simple server section looks like this:

server {
    listen       443;
    server_name  _;

    ssl                  on;
    ssl_certificate      cert.pem;
    ssl_certificate_key  cert.key;

    ssl_session_timeout  5m;

    ssl_protocols  SSLv2 SSLv3 TLSv1;
    ssl_ciphers  ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
    ssl_prefer_server_ciphers   on;

    ssl_client_certificate ca.pem;
    ssl_verify_client on;
    ssl_verify_depth 1;

    location / {
        root   html;
        index  index.html index.htm;
    }
}

For the contents of ca.pem, I have tried using only the intermediate CA and also concatenating the intermediate CA cert and the root CA cert, i.e. something like:

cp intermediate.crt ca.pem
cat root.crt >> ca.pem

I have also validated that the certificate is valid from openssl's perspective when using that same CA chain:

openssl verify -CAfile /etc/nginx/ca.pem certs/client.crt 
certs/client.crt: OK

I have experimented with setting ssl_verify_depth explicitly to 1 (as above) and then even 0 (not sure what that number means exactly), but still get same error.

The error I get in all variants of the intermed CA is "400 Bad Request" and more specifically "The SSL certificate error" (not sure what that means exactly).

Maybe nginx just doesn't support cert chains for intermediate certs? Any help greatly appreciated!

8 Answers 8

60

Edit: I had also this "problem", solution and explanation is at the bottom of the text.

It seemed like nginx doesn't support intermediate certificates. My certs self created: (RootCA is selfsigned, IntrermediateCA1 is signed by RootCA, etc.)

RootCA -> IntermediateCA1 -> Client1 
RootCA -> IntermediateCA2 -> Client2

I want to use in nginx "IntermediateCA1", to allow access to site only to owner of the "Client1" certificate.

When I put to "ssl_client_certificate" file with IntermediateCA1 and RootCA, and set "ssl_verify_depth 2" (or more) , clients can login to site both using certificate Client1 and Client2 (should only Client1). The same result is when I put to "ssl_client_certificate" file with only RootCA - both clients can login.

When I put to "ssl_client_certificate" file with only IntermediateCA1, and set "ssl_verify_depth 1" (or "2" or more - no matter) , it is imposible to log in, I get error 400. And in debug mode i see logs:

verify:0, error:20, depth:1, subject:"/C=PL/CN=IntermediateCA1/[email protected]",issuer: "/C=PL/CN=RootCA/[email protected]"
verify:0, error:27, depth:1, subject:"/C=PL/CN=IntermediateCA1/[email protected]",issuer: "/C=PL/CN=RootCA/[email protected]"
verify:1, error:27, depth:0, subject:"/C=PL/CN=Client1/[email protected]",issuer: "/C=PL/CN=IntermediateCA1/[email protected]"
(..)
client SSL certificate verify error: (27:certificate not trusted) while reading client request headers, (..)

I thing this is a bug. Tested on Ubuntu, nginx 1.1.19 and 1.2.7-1~dotdeb.1, openssl 1.0.1. I see that nginx 1.3 has few more options about using client certificates, but I'dont see solution to this problem.

Currently, the only one way to separate clients 1 and 2 is to create two, selfsigned RootCAs, but this is only workaround..

Edit 1: I've reported this issue here: http://trac.nginx.org/nginx/ticket/301

Edit 2" *Ok, it's not a bug, it is feature ;)*

I get response here: http://trac.nginx.org/nginx/ticket/301 It is working, you must only check what your ssl_client_i_dn is (. Instead of issuer you can use also subject of certificate, or what you want from http://wiki.nginx.org/HttpSslModule#Built-in_variables

This is how certificate verification works: certificate must be verified up to a trusted root. If chain can't be built to a trusted root (not intermediate) - verification fails. If you trust root - all certificates signed by it, directly or indirectly, will be successfully verified.

Limiting verification depth may be used if you want to limit client certificates to a directly issued certificates only, but it's more about DoS prevention, and obviously it can't be used to limit verificate to intermediate1 only (but not intermediate2).

What you want here is some authorization layer based on the verification result - i.e. you may want to check that client's certificate issuer is intermediate1. Simplest solution would be to reject requests if issuer's DN doesn't match one allowed, e.g. something like this (completely untested):

[ Edit by me, it is working correctly in my configuration ]

server {
    listen 443 ssl;

    ssl_certificate ...
    ssl_certificate_key ...

    ssl_client_certificate /path/to/ca.crt;
    ssl_verify_client on;
    ssl_verify_depth 2;

    if ($ssl_client_i_dn != "/C=PL/CN=IntermediateCA1/[email protected]") {
        return 403;
    }
}
6
  • 4
    To determine the issuer DN of a client certificate, use the following command: openssl x509 -noout -in </path/to/client/certificate.crt> -issuer
    – willydee
    Commented Sep 24, 2014 at 12:45
  • 4
    I thought the raison d'être of intermediate certificates is that they can be revoked (whereas the root, being used only to sign intermediate certificates, can be protected much better and only used on occasion on an air-gapped system or through a hardware security module). So how would intermediate certificate revocation be carried out with this Nginx setup? The ssl_crl parameter is only used for the client certificates themselves. Commented May 14, 2015 at 21:44
  • I have same problem and solved it without additional authentication. I think you don't need to check for $ssl_client_i_dn by your self even you have not trusted intermediate and should use if ($ssl_client_verify != SUCCESS) instead. Check if the certificate signed with attribute called "clientAuth" by: openssl x509 -in /path/to/client/cert -noout -purpose | grep 'SSL client :' Checkout this link: serverfault.com/questions/875229/… It worked for me!
    – Amr Ashraf
    Commented Jun 19, 2020 at 23:22
  • @DisplayName wouldn't your server fail to validate the client certificate, if its issuer was revoked?
    – deed02392
    Commented Sep 29, 2020 at 16:40
  • @AmrAshraf I think you are referring to a completely different matter here
    – deed02392
    Commented Sep 29, 2020 at 16:52
11

Have you tried increasing ssl_verify_depth directive? Docs say:

(it) sets a verification depth in the client certificates chain.

But your verify depth is 1. You say:

I have experimented with setting ssl_verify_depth explicitly to 1 (as above) and then even 0 (not sure what that number means exactly), but still get same error.

So, try 2 or 3..

PS: Everywhere where I find this problem mentioned, its told to combine intermediate CA certificates with you server cert. into one file (as @vikas-nalwar suggested and you did) in order of verification (but i'm not sure if the order matters) and roughly speaking set ssl_verify_depth to number of certs in the bundle.

3
  • This suggestion makes sense; I seem to remember also trying larger numbers, but I might be wrong. The docs do suggest that this is the knob I want to turn, you're right. I will try to find some time to verify this (we dropped nginx due to problems in other areas, so I don't have a ready setup to test the theory, but shouldn't take long to re-create).
    – Hans L
    Commented Jun 30, 2012 at 2:20
  • the order matters; the server cert needs to be first in the combined/chained file
    – wkhatch
    Commented Oct 21, 2013 at 1:38
  • From my testing, if the chain is 3 certs long, setting ssl_verify_depth to 3 doesn't enforce a length of 3, rather verification will stop after 3 certs, and succeed, or if you send a cert signed directly by the Root (length is 2 certs) it also succeeds because it reached the Root. Commented Oct 21, 2020 at 7:54
2

I have to say its working fine for me with nginx/1.13.2, i.e.

  • I have one root CA that signed two intermediate CAs
  • both intermediates each signed a client
  • I concat the certs like cat client-intermediate1.crt ca-client.crt > ca.chained1.crt and cat client-intermediate2.crt ca-client.crt > ca.chained2.crt and cat ca.chained1.crt ca.chained2.crt > ca.multiple.intermediate.crt

  • if I only put ca.chained1.crt as ssl_client_certificate then only client1.crt can connect, likewise for ca.chained2.crt/client2.crt

  • when I use ca.multiple.intermediate.crt then both clients can connect

for revoking an intermediate, simply remove the cert chain from the ca.multiple.intermediate.crt

here is the relevant config. its also has high security settings

# minimum settings for ssl client auth 
ssl_client_certificate /etc/ssl/ca.multiple.intermediate.crt;
ssl_verify_client on;
ssl_verify_depth 2;

# ssl high security settings (as of writing this post)
ssl_protocols TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
ssl_ecdh_curve secp384r1;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;

if you want to parse out the certs CN and pass it on to backend, then add this OUTSIDE the server {.. block

# parse out CN
map $ssl_client_s_dn $ssl_client_s_dn_cn {
    default "should_not_happen";
    ~CN=(?<CN>[^,]+) $CN;
}

and INSIDE the block you can use it then

# add headers for backend containing SSL DN/CN
add_header X-SSL-client-s-dn $ssl_client_s_dn;
add_header X-SSL-client-s-dn_cn $ssl_client_s_dn_cn;
4
  • @HansL ye I think nginx got fixed in regard of this. I didnt notice a key difference to Jacks accepted answer that would explain it
    – pHiL
    Commented Jul 19, 2017 at 21:46
  • 1
    thanks for demonstrating this, but thought you'd want to know that simply removing the cert chain from your ca.multiple.intermediate.crt does not revoke your intermediate. Clients are still able to authenticate if they can provide the intermediate ca bundled with their client cert, e.g.: curl --cert <(cat client1.crt client-intermediate1.crt) --key client1.key It seems as long as the client passed enough to any chainable root defined in ssl_client_certificate, it will authenticate.
    – Marc
    Commented Nov 4, 2019 at 20:02
  • 1
    No! I don't see this behaviour (Nginx 1.14.2-2). Putting a chain of certificates in the file for ssl_client_certificate allows any client that derives (directly or not) from the root CA. This is consistent with the doc that says the file is a list of authorized CA.
    – mimo
    Commented Aug 17, 2020 at 20:48
  • @mimo I am also observing this behaviour, so I think this answer is inaccurate
    – deed02392
    Commented Sep 29, 2020 at 16:38
1

ssl_verify_depth -> sets a verification depth in the client certificates chain

Authority provides a bundle of chained certificates which should be concatenated to the signed server certificate. The server certificate must appear before the chained certificates in the combined file

'$ openssl s_client -connect www.godaddy.com:443

...

Certificate chain
 0 s:/C=US/ST=Arizona/L=Scottsdale/1.3.6.1.4.1.311.60.2.1.3=US
     /1.3.6.1.4.1.311.60.2.1.2=AZ/O=GoDaddy.com, Inc
     /OU=MIS Department/CN=www.GoDaddy.com
     /serialNumber=0796928-7/2.5.4.15=V1.0, Clause 5.(b)
   i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc.
     /OU=http://certificates.godaddy.com/repository
     /CN=Go Daddy Secure Certification Authority
     /serialNumber=07969287
 1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc.
     /OU=http://certificates.godaddy.com/repository
     /CN=Go Daddy Secure Certification Authority
     /serialNumber=07969287
   i:/C=US/O=The Go Daddy Group, Inc.
     /OU=Go Daddy Class 2 Certification Authority
 2 s:/C=US/O=The Go Daddy Group, Inc.
     /OU=Go Daddy Class 2 Certification Authority
   i:/L=ValiCert Validation Network/O=ValiCert, Inc.
     /OU=ValiCert Class 2 Policy Validation Authority
     /CN=http://www.valicert.com//[email protected]'

In this example the subject (“s”) of the www.GoDaddy.com server certificate #0 is signed by an issuer (“i”) which itself is the subject of the certificate #1, which is signed by an issuer which itself is the subject of the certificate #2, which signed by the well-known issuer ValiCert, Inc. whose certificate is stored in the browsers’ built-in certificate base

Nginx use ssl_verify_depth directive to dig into the cert bundle to verify the issuer in its trusted store which is stored in proxy_ssl_trusted_certificate

1

@Jack and @HansL, a solution to allow clients from only one IntermediateCA1 is to use nginx config ssl_trusted_certificate. From nginx documentation:

Specifies a file with trusted CA certificates in the PEM format used to verify client certificates and OCSP responses if ssl stapling is enabled. In contrast to the certificate set by ssl client certificate, the list of these certificates will not be sent to clients.

These settings worked for me (but with other PKI of course). In the first file only IntermediateCA1 is present. In the latter only RootCA.

ssl_client_certificate     /etc/nginx/ssl/ca-bundle-for-client-selection-filtering.crt;
ssl_trusted_certificate    /etc/nginx/ssl/ca-bundle-for-client-cert-valdiation.crt;  
5
  • This is NOT a secure solution, all it does is prevent the certificate from being selected with the nice UI prompt in your browser, when a real attacker could just forcibly send a certificate that is ultimately signed by either root or intermediate.
    – deed02392
    Commented Sep 29, 2020 at 16:36
  • Yes, you would need to by other means verify that presented client certificate is issued by IntermediateCA and not the RootCA. It all depends on what PKI you have and trust ecosystem.
    – Magnum
    Commented Sep 30, 2020 at 19:30
  • 1
    But this is the only way to filter user selection dialog so that certificates issued by IntermediateCA1 and not IntermediateCA2 are selectable, but still have nginx validating the root. If putting rootCA in ssl_client_certificate, user can't present an intermediate certificate, but certificates from both CAs are selectable and accepted by nginx which we don't want in this specific use case. Right?
    – Magnum
    Commented Sep 30, 2020 at 19:41
  • Yes it's very nice for UX to simplify their choice of certificate, I just had to comment to try and help people realise that just because it reduces what you can choose client side when building this, it isn't actually prohibiting those certificates from working, which people might think it means, especially because that is what the OP was looking to achieve
    – deed02392
    Commented Sep 30, 2020 at 20:13
  • Thanks @Magnum, this answer combined with the issuer check from the accepted answer makes the most complete solution. Commented Feb 2, 2021 at 10:31
1

Update: I believe that you want to enable client validation on your server side. If this is so then, create the certificate chain properly. Try the following in exact same order. Use the certchain.pem.

  cat intermediate.crt >> certchain.pem
  cat root.crt >> certchain.pem
7
  • That doesn't make sense to me. I don't have a single client certificate (necessarily); every client that connects would have its own cert signed by same intermediate CA.
    – Hans L
    Commented Dec 8, 2011 at 17:50
  • In your case where client authentication is enabled, every client that should be able to the server, should be trusted by your server. This means that you need to import every client certificate to the server truststore beforehand. The trustchain travel forward so you need to import the client certificates first and then the intermediary and then the root.
    – Drona
    Commented Dec 9, 2011 at 12:31
  • 3
    That doesn't make any sense and completely defeats the point of having a common certificate authority that is signing these certs. Also, I should point out that I don't need to append the client cert when using a root CA; that works just fine. It's only when using an intermediate CA that there is an issue.
    – Hans L
    Commented Dec 9, 2011 at 17:57
  • Ohh Yes, you are right! Client certificate need not be imported. Just the intermediary and the root CA certificates need to be there. Sorry about the confusion.
    – Drona
    Commented Dec 11, 2011 at 7:03
  • You can omit ssl_client_certificate and concatenate everything in your ssl_certificate as Vikas pointed out.
    – m33lky
    Commented Feb 10, 2012 at 2:45
0

another easy way is to concatenate certificates (including domain certifate) in a single file and use that on your servers and nginx conf file

cat www.example.com.crt bundle.crt > www.example.com.chained.crt

Always remember to use server certificate first and then only CA server certificates

You can read more about at http://nginx.org/en/docs/http/configuring_https_servers.html#chains

3
  • 1
    Did you even read the question? Of course, I tried concatenating the certs; this is pretty standard SSL practice... I don't see anything about client cert auth in the link you provided.
    – Hans L
    Commented Jun 16, 2015 at 13:01
  • @HansL - What I comprehended was that you were facing issues using certificate issued from an intermediate CA. This simply means that your certificate chain was missing authority linking up to root CA. Nginx can help if you concatenate certificates including chain upto root CA in a single file. The part of page I wanted you to focus was nginx.org/en/docs/http/configuring_https_servers.html#chains.
    – Naveen
    Commented Jun 17, 2015 at 7:49
  • 1
    Yes, but in my question I specifically said that I tried concatenating them together. Yes, this works just fine for server certificates, but not for client auth (at least at the time of writing), that is why my question is specifically focused on SSL certs for client authentication.
    – Hans L
    Commented Jun 18, 2015 at 13:03
-1

as I was strugling with nginx and cloudflare,
these lines did the trick for me:

ssl_client_certificate    /etc/nginx/ssl/ca-bundle-client.crt;  
ssl_verify_client optional_no_ca;  
ssl_verify_depth 2;

the second line with optional_no_ca is the important part

1
  • 6
    This just disables CA validation completely! That's a really bad thing if you're using client verification to make sure only the right people can use the service.
    – Aapeli
    Commented Sep 2, 2018 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.