# How to pass a certificate to an upstream

**URL:** <https://www.ruby-forum.com/t/how-to-pass-a-certificate-to-an-upstream/202952>\
**Category:** NGINX\
**Created:** [February 9, 2011, 2:55pm UTC](https://www.ruby-forum.com/t/how-to-pass-a-certificate-to-an-upstream/202952 "2011-02-09T14:55:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\
**Post date:** [February 9, 2011, 2:55pm UTC](https://www.ruby-forum.com/t/how-to-pass-a-certificate-to-an-upstream/202952/1 "2011-02-09T14:55:32Z")

</div>

Hi,

I want to put NGINX in front of a server that requires  
client-certificates.  
I need to pass the certificate to the upstream.

How does one do that?

The upstream is a native jboss server (EJBCA in fact).

Best Regards,  
Rainer

---

<div class="post-metadata">

**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\
**Post date:** [February 9, 2011, 3:01pm UTC](https://www.ruby-forum.com/t/how-to-pass-a-certificate-to-an-upstream/202952/2 "2011-02-09T15:01:48Z")

</div>

On Wed, Feb 09, 2011 at 02:54:21PM +0100, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> I want to put NGINX in front of a server that requires client-certificates.  
> I need to pass the certificate to the upstream.
> 
> How does one do that?
> 
> The upstream is a native jboss server (EJBCA in fact).

You can pass client certificate using some header, X-SSL-CERT, for  
example:  
proxy\_set\_header X-SSL-CERT $ssl\_client\_cert;  
But I do not know how to get process it on jboss side.

–  
Igor S.

> **[Igor Sysoev](http://sysoev.ru/en/)**

---

<div class="post-metadata">

**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\
**Post date:** [February 9, 2011, 3:10pm UTC](https://www.ruby-forum.com/t/how-to-pass-a-certificate-to-an-upstream/202952/3 "2011-02-09T15:10:36Z")

</div>

> You can pass client certificate using some header, X-SSL-CERT, for  
> example:  
> proxy\_set\_header X-SSL-CERT $ssl\_client\_cert;  
> But I do not know how to get process it on jboss side.

OK, so I would need to ask on the EJBCA-side of things, it seems?

I read about $ssl\_client\_cert but couldn’d figure out how to pass it to  
the upstream.

Thanks, Igor.

Best Regards,  
Rainer

---

<div class="post-metadata">

**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\
**Post date:** [February 9, 2011, 3:20pm UTC](https://www.ruby-forum.com/t/how-to-pass-a-certificate-to-an-upstream/202952/4 "2011-02-09T15:20:00Z")

</div>

On Wed, Feb 09, 2011 at 03:09:08PM +0100, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> > You can pass client certificate using some header, X-SSL-CERT, for  
> > example:  
> > proxy\_set\_header X-SSL-CERT $ssl\_client\_cert;  
> > But I do not know how to get process it on jboss side.
> 
> OK, so I would need to ask on the EJBCA-side of things, it seems?
> 
> I read about $ssl\_client\_cert but couldn’d figure out how to pass it to  
> the upstream.

Yes, on backend side the header should conatains a client certificate  
in PEM format.

–  
Igor S.

> **[Igor Sysoev](http://sysoev.ru/en/)**