# One link/area on a https site with a different SSL config? **URL:** \ **Category:** NGINX\ **Created:** [January 9, 2014, 10:43pm UTC](https://www.ruby-forum.com/t/one-link-area-on-a-https-site-with-a-different-ssl-config/238437 "2014-01-09T22:43:27Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Detlef\_R](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/58f4c7/32.png) [@Detlef\_R](https://www.ruby-forum.com/u/Detlef_R)\ **Post date:** [January 9, 2014, 10:43pm UTC](https://www.ruby-forum.com/t/one-link-area-on-a-https-site-with-a-different-ssl-config/238437/1 "2014-01-09T22:43:27Z")
Hi, On a Wordpress website that works with a basic StartSSL certificate I wonder if it is possible to configure nginx (1.4.4) to use a separate self-signed cert with client certificate authentication for wp-login.php and any link in wp-admin/ ? So the regular [https://blog.example.org/[some/link]](https://blog.example.org/%5Bsome/link%5D) uses the StartSSL cert for the https session But the [https://blog.example.org/wp-login.php](https://blog.example.org/wp-login.php) and [https://blog.example.org/wp-admin/](https://blog.example.org/wp-admin/)\* use a self-signed certficate with client certificate authentication for the https session Is that possible? If yes, any keywords or what to read up on are much appreciated. Thanks, Patrick ---
**Author:** ![lynchnco](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/c77e96/32.png) [@lynchnco](https://www.ruby-forum.com/u/lynchnco)\ **Post date:** [January 10, 2014, 4:28am UTC](https://www.ruby-forum.com/t/one-link-area-on-a-https-site-with-a-different-ssl-config/238437/2 "2014-01-10T04:28:39Z")
Hi Styopa, On 09-01-14 22:48, Styopa S. wrote: > Patrick, > > It’s not possible, because SSL works on lower level (session layer) than HTTP > (application layer). Thank you for your feedback. That’s unfortunate. I hope to see flexible SSL config one day as an enhancement (if possible). For now I guess I’ll do IP based deny/allow instead. Regards, Patrick ---
**Author:** ![lynchnco](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/c77e96/32.png) [@lynchnco](https://www.ruby-forum.com/u/lynchnco)\ **Post date:** [January 10, 2014, 9:13am UTC](https://www.ruby-forum.com/t/one-link-area-on-a-https-site-with-a-different-ssl-config/238437/3 "2014-01-10T09:13:44Z")
Patrick L. wrote in post #1132735: > On 09-01-14 22:48, Styopa S. wrote: > > > Patrick, > > > > It’s not possible, because SSL works on lower level (session layer) than HTTP > > (application layer). > > Thank you for your feedback. That’s unfortunate. I hope to see flexible > SSL config one day as an enhancement (if possible). It is not possible, not with nginx nor any other web server. Read up on how the SSL handshake and HTTP over SSL works, and it should become clear. ---
**Author:** ![lynchnco](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/c77e96/32.png) [@lynchnco](https://www.ruby-forum.com/u/lynchnco)\ **Post date:** [January 10, 2014, 9:17am UTC](https://www.ruby-forum.com/t/one-link-area-on-a-https-site-with-a-different-ssl-config/238437/4 "2014-01-10T09:17:12Z")
On Jan 10, 2014, at 12:13 , Andreas S. wrote: > It is not possible, not with nginx nor any other web server. Read up on > how the SSL handshake and HTTP over SSL works, and it should become > clear. It is actually possible, at least Apache can do this with SSL renegotiation. But nginx currently does not support this. ---
**Author:** ![lynchnco](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/c77e96/32.png) [@lynchnco](https://www.ruby-forum.com/u/lynchnco)\ **Post date:** [January 10, 2014, 2:23pm UTC](https://www.ruby-forum.com/t/one-link-area-on-a-https-site-with-a-different-ssl-config/238437/5 "2014-01-10T14:23:20Z")
On 10-01-14 09:16, Igor S. wrote: > > > SSL config one day as an enhancement (if possible). > > > > It is not possible, not with nginx nor any other web server. Read up on > > how the SSL handshake and HTTP over SSL works, and it should become > > clear. > > It is actually possible, at least Apache can do this with SSL renegotiation. > But nginx currently does not support this. Thanks Igor. It’s good to know that it’s possible with Apache. I prefer to stay with nginx so will use IP deny/allow for now. Regards, Patrick ---
**Author:** ![lynchnco](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/c77e96/32.png) [@lynchnco](https://www.ruby-forum.com/u/lynchnco)\ **Post date:** [January 9, 2014, 10:49pm UTC](https://www.ruby-forum.com/t/one-link-area-on-a-https-site-with-a-different-ssl-config/238437/6 "2014-01-09T22:49:18Z")
Patrick, It’s not possible, because SSL works on lower level (session layer) than HTTP (application layer). On Thursday, January 09, 2014 10:42:55 PM Patrick L. wrote: > But the [https://blog.example.org/wp-login.php](https://blog.example.org/wp-login.php) and > nginx mailing list > [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > [mailman.nginx.org archive](http://mailman.nginx.org/mailman/listinfo/nginx) > – > Best regards, > Styopa S.. ---
**Author:** ![lynchnco](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/c77e96/32.png) [@lynchnco](https://www.ruby-forum.com/u/lynchnco)\ **Post date:** [February 8, 2014, 12:45am UTC](https://www.ruby-forum.com/t/one-link-area-on-a-https-site-with-a-different-ssl-config/238437/7 "2014-02-08T00:45:57Z")
> > Patrick L. wrote in post #1132735: > > > > > On 09-01-14 22:48, Styopa S. wrote: > > > > > > > Patrick, > > > > > > > > It’s not possible, because SSL works on lower level (session layer) > > > > than HTTP > > > > (application layer). > > > > > > Thank you for your feedback. That’s unfortunate. I hope to see flexible > > > SSL config one day as an enhancement (if possible). > > > > It is not possible, not with nginx nor any other web server. Read up on > > how the SSL handshake and HTTP over SSL works, and it should become > > clear. > It is actually possible, at least Apache can do this with SSL > renegotiation. > But nginx currently does not support this. Expanding on this question, is it possible to use a different set of certs for the client side and another set for the upstream server side? Right now I can defined a server module with ssl and specify the ssl certificates and specify a https protocol for proxy\_pass for a location. But both connections end up using the same certificates specified with $ssl\_certificate. How can I specify different certificates for the client side connection and upstream side connection? Thanks in advance. Posted at Nginx Forum: [http://forum.nginx.org/read.php?2,246208,247293#msg-247293](http://forum.nginx.org/read.php?2,246208,247293#msg-247293)