# Question about client certs **URL:** \ **Category:** NGINX\ **Created:** [February 2, 2016, 4:33am UTC](https://www.ruby-forum.com/t/question-about-client-certs/243984 "2016-02-02T04:33:17Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Rafa\_F](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/958977/32.png) [@Rafa\_F](https://www.ruby-forum.com/u/Rafa_F)\ **Post date:** [February 2, 2016, 4:33am UTC](https://www.ruby-forum.com/t/question-about-client-certs/243984/1 "2016-02-02T04:33:17Z")
Hi Is it possible with nginx to do this > **[ABC Home Page - ABC.com](https://abc.com/)** > > Watch the ABC Shows online at abc.com. Get exclusive videos and free episodes. / /noclientcert/ /clientcert/ so you can get to / with no client cert, but /clientcert/ you need a cert, but for /noclientcert/ you don’t need a cert. Looks like from the config doco you can only set it for the whole tree … A ---
**Author:** ![Alex\_Samad](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/b4bc9f/32.png) [@Alex\_Samad](https://www.ruby-forum.com/u/Alex_Samad)\ **Post date:** [February 2, 2016, 7:06am UTC](https://www.ruby-forum.com/t/question-about-client-certs/243984/2 "2016-02-02T07:06:28Z")
Alex Samad: > Is it possible with nginx to do this > > [https://www.abc.com](https://www.abc.com) > / > /noclientcert/ > /clientcert/ > > so you can get to / with no client cert, but /clientcert/ you need a > cert, but for /noclientcert/ you don’t need a cert. as far as I learned it’s not possible and the usual answer to such feature requests is: “use different virtual hosts” Andreas ---
**Author:** ![Alex\_Samad](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/b4bc9f/32.png) [@Alex\_Samad](https://www.ruby-forum.com/u/Alex_Samad)\ **Post date:** [February 2, 2016, 8:52am UTC](https://www.ruby-forum.com/t/question-about-client-certs/243984/3 "2016-02-02T08:52:12Z")
Your question shows you need to understand how HTTP over TLS works. TLS enciphers HTTP content, thus nothing is readable (either headers or body). How do you select the right certificate based on HTTP content? You can’t. Wait, Host-HTTP-Header-based certificate delivery exists, how is that possible? With TLS it is basically impossible, but it works though a TLS extension called Server Name Indication (SNI). nginx docs talk about that: > **[Configuring HTTPS servers](http://nginx.org/en/docs/http/configuring_https_servers.html#name_based_https_servers)** > > To configure an HTTPS server, the ssl parameter must be enabled on listening sockets in the server block, and the locations of the server certificate and private key files should be specified: ## Now what you ask requires access to enciphered HTTP content. Short answer: there is no way to do that, you will need to use different servers, either using SNI (as Andreas suggested) or separate IP addresses. _B. R._ ---
**Author:** ![Alex\_Samad](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/b4bc9f/32.png) [@Alex\_Samad](https://www.ruby-forum.com/u/Alex_Samad)\ **Post date:** [February 2, 2016, 10:57am UTC](https://www.ruby-forum.com/t/question-about-client-certs/243984/4 "2016-02-02T10:57:47Z")
Dear Alex. Am 02-02-2016 04:32, schrieb Alex Samad: > so you can get to / with no client cert, but /clientcert/ you need a > cert, but for /noclientcert/ you don’t need a cert. > > Looks like from the config doco you can only set it for the whole tree > … I would try to use this directives > **[Module ngx\_http\_ssl\_module](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_verify_client)** > > The ngx\_http\_ssl\_module module provides the necessary support for HTTPS. > **[Module ngx\_http\_map\_module](http://nginx.org/en/docs/http/ngx_http_map_module.html)** and in a map make something like this. map $ssl\_client\_cert $clientcert { default “”; “~.\*CLIENT\_CERT\_CHECK” clientcert; } and location $clientcert { } location no$clientcert { } is this possible ;-)? BR Aleks ---
**Author:** ![Alex\_Samad](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/b4bc9f/32.png) [@Alex\_Samad](https://www.ruby-forum.com/u/Alex_Samad)\ **Post date:** [February 3, 2016, 9:37am UTC](https://www.ruby-forum.com/t/question-about-client-certs/243984/5 "2016-02-03T09:37:48Z")
Am 02-02-2016 23:22, schrieb Alex Samad: > Yep I think thats what i was asking. Cool it would be nice if you can tell us if it’s works and how was your solution 😉 BR Aleks ---
**Author:** ![Alex\_Samad](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/b4bc9f/32.png) [@Alex\_Samad](https://www.ruby-forum.com/u/Alex_Samad)\ **Post date:** [February 2, 2016, 11:22pm UTC](https://www.ruby-forum.com/t/question-about-client-certs/243984/6 "2016-02-02T23:22:35Z")
Yep I think thats what i was asking. We have a home grown RP at work that does it and IIS used to do it, apply cert requirements on part of the tree. ---
**Author:** ![Alex\_Samad](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/b4bc9f/32.png) [@Alex\_Samad](https://www.ruby-forum.com/u/Alex_Samad)\ **Post date:** [February 3, 2016, 10:22pm UTC](https://www.ruby-forum.com/t/question-about-client-certs/243984/7 "2016-02-03T22:22:28Z")
On Wed, Feb 03, 2016 at 09:37:25AM +0100, Aleksandar L. wrote: > Am 02-02-2016 23:22, schrieb Alex Samad: Hi there, > Cool it would be nice if you can tell us if it’s works and how was > your solution 😉 I think that “location” does not take variables, and so this will not work. More below. > > On 2 February 2016 at 20:56, Aleksandar L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > > > Am 02-02-2016 04:32, schrieb Alex Samad: > > > > Looks like from the config doco you can only set it for the > > > > whole tree … Untested by me, but if you set ssl\_verify\_client optional; and then within your location ^~ /clientcert/ {} you have something like if ($ssl\_client\_verify != SUCCESS) { return 403; } would that fit your needs? (If the content below /clientcert/ is all handled by an external process, then possibly it could do its own validation or verification using values provided by nginx.) [Module ngx\_http\_ssl\_module](http://nginx.org/r/$ssl_client_verify) for some details. Good luck with it, ## f Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)