Score:0

Mutual TLS on NGINX with 2 CAs?

jp flag

I'm curious, if I have a cert and private key issued by a well-known CA such as letsencrypt to establish a secure connection, but I'm using mutual TLS on NGINX, is it possible to have only the mutual tls auth reference a custom CA?

For example:

Connection is established and verified from Let's Encrypt CA. When client visits a path that requires a client cert to be present, I want that certificate to validate against my own custom CA I made via OpenSSL. Is that flow possible by just adding the CA to be my custom CA?

dave_thompson_085 avatar
jp flag
Yes, nginx verifies the client cert (if requested and obtained) against one or more CA certs in either `ssl_client_certificate` or `ssl_trusted_certificate` which is/are independent of and can be different from the (one) CA used for the server's own cert. [See the documentation](https://nginx.org/en/docs/http/ngx_http_ssl_module.html)
Ryan avatar
jp flag
Thanks Dave for the info
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.