nginx 代理服务器配置双向证书验证的方法

生成证书链

用脚本生成一个根证书, 一个中间证书(intermediate), 三个客户端证书.

脚本来源于(有修改)

中间证书的域名为 localhost.

#!/bin/bash -x

set -e

for c in `echo root-ca intermediate`; do

 mkdir $c
 cd $c
 mkdir certs crl newcerts private
 cd ..

 echo 1000 > $c/serial
 touch $c/index.txt $c/index.txt.attr

 echo '
[ ca ]
default_ca = ca_default
[ ca_default ]
dir      = '$c'  # where everything is kept
certs     = $dir/certs        # where the issued certs are kept
crl_dir    = $dir/crl        # where the issued crl are kept
database    = $dir/index.txt      # database index file.
new_certs_dir = $dir/newcerts      # default place for new certs.
certificate  = $dir/cacert.pem        # the ca certificate
serial     = $dir/serial        # the current serial number
crl      = $dir/crl.pem        # the current crl
private_key  = $dir/private/ca.key.pem    # the private key
randfile    = $dir/.rnd   # private random number file
nameopt    = default_ca
certopt    = default_ca
policy     = policy_match
default_days  = 365
default_md   = sha256

[ policy_match ]
countryname      = optional
stateorprovincename  = optional
organizationname    = optional
organizationalunitname = optional
commonname       = supplied
emailaddress      = optional

[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name

[req_distinguished_name]

[v3_req]
basicconstraints = ca:true
' > $c/openssl.conf
done

openssl genrsa -out root-ca/private/ca.key 2048
openssl req -config root-ca/openssl.conf -new -x509 -days 3650 -key root-ca/private/ca.key -sha256 -extensions v3_req -out root-ca/certs/ca.crt -subj '/cn=root-ca'

openssl genrsa -out intermediate/private/intermediate.key 2048
openssl req -config intermediate/openssl.conf -sha256 -new -key intermediate/private/intermediate.key -out intermediate/certs/intermediate.csr -subj '/cn=localhost.'
openssl ca -batch -config root-ca/openssl.conf -keyfile root-ca/private/ca.key -cert root-ca/certs/ca.crt -extensions v3_req -notext -md sha256 -in intermediate/certs/intermediate.csr -out intermediate/certs/intermediate.crt

mkdir out

for i in `seq 1 3` ; do
 openssl req -new -keyout out/$i.key -out out/$i.request -days 365 -nodes -subj "/cn=$i.example.com" -newkey rsa:2048
 openssl ca -batch -config root-ca/openssl.conf -keyfile intermediate/private/intermediate.key -cert intermediate/certs/intermediate.crt -out out/$i.crt -infiles out/$i.request
done

服务器

nginx 配置

worker_processes 1;

events {
  worker_connections 1024;
}

stream{
  upstream backend{
    server 127.0.0.1:8080;
  }

  server {
    listen 8888 ssl;
    proxy_pass backend;
    ssl_certificate   intermediate.crt;
    ssl_certificate_key intermediate.key;
    ssl_verify_depth 2;
    ssl_client_certificate root.crt;
    ssl_verify_client optional_no_ca;
  }
}

客户端

curl \
 -i \
 -vv \
 -x https://localhost:8888/ \
 --proxy-cert client1.crt \
 --proxy-key client1.key \
 --proxy-cacert ca.crt \
 https://www.baidu.com/

以上就是本文的全部内容，希望对大家的学习有所帮助，也希望大家多多支持。