# Client certificates require nginx restart

**URL:** <https://www.ruby-forum.com/t/client-certificates-require-nginx-restart/200160>\
**Category:** NGINX\
**Created:** [December 6, 2010, 11:43am UTC](https://www.ruby-forum.com/t/client-certificates-require-nginx-restart/200160 "2010-12-06T11:43:23Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dobai-Pataky\_BSSSSl](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/77aa72/32.png) [@Dobai-Pataky\_BSSSSl](https://www.ruby-forum.com/u/Dobai-Pataky_BSSSSl)\
**Post date:** [December 6, 2010, 11:43am UTC](https://www.ruby-forum.com/t/client-certificates-require-nginx-restart/200160/1 "2010-12-06T11:43:23Z")

</div>

Hi,  
I have setup nginx as a ssl reverse proxy for tomcat. I am doing  
matching based on client DN like that:

```auto
  ssl on;
  ssl_certificate /etc/ssl/server.crt;
  ssl_certificate_key /etc/ssl/server.key;
  ssl_client_certificate /etc/ssl/certs/ca.crt;
  ssl_verify_client on;

location /client2 {
    if ($ssl_client_s_dn = "/C=US/ST=OH/O=TEST.US/OU=ADM/CN=client2") {
      proxy_pass http://127.0.0.1:8180;
      break;
    }
  }
```

Everything works fine except that I have to restart nginx every time new  
certificate is imported into a client browser. I would like to make them  
work without restarting nginx. Is it possible or am I doing something  
wrong ? Thanks in advance for any help

Posted at Nginx Forum:

> **[Client certificates require nginx restart](https://forum.nginx.org/read.php?2,155960,155960#msg-155960)**
>
> Hi, I have setup nginx as a ssl reverse proxy for tomcat. I am doing matching based on client DN like that: \[code\] ssl on; ssl\_certificate /etc/ssl/server.crt; ssl\_certificate\_key /etc/ssl/server.key; ssl\_client\_certificate /etc/ssl/certs/ca.crt

---

<div class="post-metadata">

**Author:** ![kefear](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/ee7513/32.png) [@kefear](https://www.ruby-forum.com/u/kefear)\
**Post date:** [December 6, 2010, 1:22pm UTC](https://www.ruby-forum.com/t/client-certificates-require-nginx-restart/200160/2 "2010-12-06T13:22:33Z")

</div>

Hello!

On Mon, Dec 06, 2010 at 05:42:01AM -0500, kefear wrote:

> work without restarting nginx. Is it possible or am I doing something  
> wrong ? Thanks in advance for any help

It’s likely to be caused by browser using previously established  
ssl session (with old client cert used in it). Restarting  
browser should help as well.

Maxim D.