# Need client cert common name as user

**URL:** <https://www.ruby-forum.com/t/need-client-cert-common-name-as-user/212058>\
**Category:** NGINX\
**Created:** [September 21, 2011, 12:39am UTC](https://www.ruby-forum.com/t/need-client-cert-common-name-as-user/212058 "2011-09-21T00:39:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\
**Post date:** [September 21, 2011, 12:39am UTC](https://www.ruby-forum.com/t/need-client-cert-common-name-as-user/212058/1 "2011-09-21T00:39:45Z")

</div>

I’m in the process of converting from lighttpd to nginx, but I’m not  
finding an equivalent of the lighttpd directive:

ssl.verifyclient.username = “SSL\_CLIENT\_S\_DN\_CN”

This sets the REMOTE\_USER environment variable for the backend FastCGI  
process, and logs the common name into the access log.

Is it possible to do this in nginx?

Thanks,

Fred

Posted at Nginx Forum:

> **[Need client cert common name as user](https://forum.nginx.org/read.php?2,215461,215461#msg-215461)**
>
> I'm in the process of converting from lighttpd to nginx, but I'm not finding an equivalent of the lighttpd directive: ssl.verifyclient.username = "SSL\_CLIENT\_S\_DN\_CN" This sets the REMOTE\_USER environment variable for the backend FastCGI...

---

<div class="post-metadata">

**Author:** ![sailorfred](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/59ef9b/32.png) [@sailorfred](https://www.ruby-forum.com/u/sailorfred)\
**Post date:** [September 21, 2011, 1:05am UTC](https://www.ruby-forum.com/t/need-client-cert-common-name-as-user/212058/2 "2011-09-21T01:05:40Z")

</div>

Hello!

On Tue, Sep 20, 2011 at 06:39:08PM -0400, sailorfred wrote:

> I’m in the process of converting from lighttpd to nginx, but I’m not  
> finding an equivalent of the lighttpd directive:
> 
> ssl.verifyclient.username = “SSL\_CLIENT\_S\_DN\_CN”
> 
> This sets the REMOTE\_USER environment variable for the backend FastCGI  
> process, and logs the common name into the access log.
> 
> Is it possible to do this in nginx?

There is no direct replacement. If you are ok with full cert subject  
DN as a user name, use something like this:

```
fastcgi_pass ...
fastcgi_param REMOTE_USER $ssl_client_s_dn;
...

```

Extracting only CN should be possible with “if” directive, though  
will require writing some regexp to parse CN from DN. (And please  
make sure to read [GitHub - nginxinc/nginx-wiki: ARCHIVED -- Source for the now archived NGINX Wiki section of https://www.nginx.com · GitHub](http://wiki.nginx.org/IfIsEvil) as “if” may cause  
problems by itself if used in location context.)

Maxim D.

---

<div class="post-metadata">

**Author:** ![sailorfred](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/59ef9b/32.png) [@sailorfred](https://www.ruby-forum.com/u/sailorfred)\
**Post date:** [September 21, 2011, 5:38am UTC](https://www.ruby-forum.com/t/need-client-cert-common-name-as-user/212058/3 "2011-09-21T05:38:38Z")

</div>

On Wed, Sep 21, 2011 at 03:05:26AM +0400, Maxim D. wrote:

> > process, and logs the common name into the access log.  
> > Extracting only CN should be possible with “if” directive, though  
> > will require writing some regexp to parse CN from DN. (And please  
> > make sure to read [GitHub - nginxinc/nginx-wiki: ARCHIVED -- Source for the now archived NGINX Wiki section of https://www.nginx.com · GitHub](http://wiki.nginx.org/IfIsEvil) as “if” may cause  
> > problems by itself if used in location context.)

The “map” directive with regex can be used instead of “if”,  
something like this:

```
  map $ssl_client_s_dn $ssl_client_s_dn_cn {
       default "";
       ~/CN=(?<CN>[^/]+) $CN;
  };

```

–  
Igor S.