# Provide site-specific SSL cert on behalf of clients **URL:** \ **Category:** NGINX\ **Created:** [May 24, 2011, 11:04pm UTC](https://www.ruby-forum.com/t/provide-site-specific-ssl-cert-on-behalf-of-clients/207378 "2011-05-24T23:04:33Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\ **Post date:** [May 24, 2011, 11:04pm UTC](https://www.ruby-forum.com/t/provide-site-specific-ssl-cert-on-behalf-of-clients/207378/1 "2011-05-24T23:04:33Z")
I’m wondering if I can configure nginx to provide a PEM SSL cert for a specific site on behalf of clients on my subnet, and how I might go about configuring, testing this. I have a cert in PEM format, and nginx 0.8.54 with SSL support, running on Ubuntu 11.04. Posted at Nginx Forum: > **[Provide site-specific SSL cert on behalf of clients](https://forum.nginx.org/read.php?2,200521,200521#msg-200521)** > > I'm wondering if I can configure nginx to provide a PEM SSL cert for a specific site on behalf of clients on my subnet, and how I might go about configuring, testing this. I have a cert in PEM format, and nginx 0.8.54 with SSL support, running on... ---
**Author:** ![urschrei](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/c37758/32.png) [@urschrei](https://www.ruby-forum.com/u/urschrei)\ **Post date:** [May 25, 2011, 8:14am UTC](https://www.ruby-forum.com/t/provide-site-specific-ssl-cert-on-behalf-of-clients/207378/2 "2011-05-25T08:14:18Z")
On Tue, May 24, 2011 at 05:04:11PM -0400, urschrei wrote: > I’m wondering if I can configure nginx to provide a PEM SSL cert for a > specific site on behalf of clients on my subnet, and how I might go > about configuring, testing this. I have a cert in PEM format, and nginx > 0.8.54 with SSL support, running on Ubuntu 11.04. Do you mean a cetificate that a client passes to a server or what ? – Igor S. ---
**Author:** ![urschrei](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/c37758/32.png) [@urschrei](https://www.ruby-forum.com/u/urschrei)\ **Post date:** [May 25, 2011, 11:15am UTC](https://www.ruby-forum.com/t/provide-site-specific-ssl-cert-on-behalf-of-clients/207378/3 "2011-05-25T11:15:59Z")
Igor, yes, it’s a client SSL cert. Posted at Nginx Forum: > **[Re: Provide site-specific SSL cert on behalf of clients](https://forum.nginx.org/read.php?2,200521,200646#msg-200646)** > > I'm wondering if I can configure nginx to provide a PEM SSL cert for a specific site on behalf of clients on my subnet, and how I might go about configuring, testing this. I have a cert in PEM format, and nginx 0.8.54 with SSL support, running on... ---
**Author:** ![urschrei](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/c37758/32.png) [@urschrei](https://www.ruby-forum.com/u/urschrei)\ **Post date:** [May 25, 2011, 11:20am UTC](https://www.ruby-forum.com/t/provide-site-specific-ssl-cert-on-behalf-of-clients/207378/4 "2011-05-25T11:20:18Z")
On Wed, May 25, 2011 at 05:15:18AM -0400, urschrei wrote: > Igor, > yes, it’s a client SSL cert. You should have a CA certificate which is used to sign client certificates. This ceritificate should be declared on server level: server { listen 443; ssl on; … ``` ssl_client_certificate ca-cert.pem; ssl_verify_client on; ``` – Igor S. ---
**Author:** ![urschrei](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/c37758/32.png) [@urschrei](https://www.ruby-forum.com/u/urschrei)\ **Post date:** [May 25, 2011, 12:27pm UTC](https://www.ruby-forum.com/t/provide-site-specific-ssl-cert-on-behalf-of-clients/207378/5 "2011-05-25T12:27:46Z")
Igor, just to make sure I’m not misunderstanding you: Usually, what happens is this: I install an SSL cert (let’s call it certA) in a client browser, so I can access https site A, which requires it. But if I have a lot of clients, I’d ideally like to have nginx proxy this cert, on behalf of my clients, so I don’t have to install it for each of them. Are you saying that in order for nginx to proxy the cert, I’ll first have to generate a CA cert on the server, and then sign the client cert (certA) with it? Won’t this result in a self-signed certificate warning every time a client tries to access site A? Posted at Nginx Forum: > **[Re: Provide site-specific SSL cert on behalf of clients](https://forum.nginx.org/read.php?2,200521,200672#msg-200672)** > > I'm wondering if I can configure nginx to provide a PEM SSL cert for a specific site on behalf of clients on my subnet, and how I might go about configuring, testing this. I have a cert in PEM format, and nginx 0.8.54 with SSL support, running on... ---
**Author:** ![urschrei](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/c37758/32.png) [@urschrei](https://www.ruby-forum.com/u/urschrei)\ **Post date:** [May 25, 2011, 12:34pm UTC](https://www.ruby-forum.com/t/provide-site-specific-ssl-cert-on-behalf-of-clients/207378/6 "2011-05-25T12:34:34Z")
On Wed, May 25, 2011 at 06:27:15AM -0400, urschrei wrote: > each of them. Are you saying that in order for nginx to proxy the cert, > I’ll first have to generate a CA cert on the server, and then sign the > client cert (certA) with it? Won’t this result in a self-signed > certificate warning every time a client tries to access site A? nginx as a client does not currently support a client certificate when it proxies a request to HTTPS backend (B). However, I do not see any security advantage when many clients look like one for backend B. – Igor S. ---
**Author:** ![urschrei](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/c37758/32.png) [@urschrei](https://www.ruby-forum.com/u/urschrei)\ **Post date:** [May 25, 2011, 12:46pm UTC](https://www.ruby-forum.com/t/provide-site-specific-ssl-cert-on-behalf-of-clients/207378/7 "2011-05-25T12:46:57Z")
> nginx as a client does not currently support a > client certificate > when it proxies a request to HTTPS backend (B). > However, I do not see > any security advantage when many clients look like > one for backend B. Thanks for clearing up the confusion. In this case, there would be no security advantage even if the cert were individually installed, since the same cert is issued to each client in the organisation, so whether the cert is proxied or not really makes no difference. Posted at Nginx Forum: [http://forum.nginx.org/read.php?2,200521,200678#msg-200678](http://forum.nginx.org/read.php?2,200521,200678#msg-200678)