# (re-post) Add "optional\_no\_ca" option to ssl\_verify\_client to enable app-only CA chain validation **URL:** \ **Category:** NGINX\ **Created:** [September 15, 2012, 1:52pm UTC](https://www.ruby-forum.com/t/re-post-add-optional-no-ca-option-to-ssl-verify-client-to-enable-app-only-ca-chain-validation/222936 "2012-09-15T13:52:44Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![aris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/258eb7/32.png) [@aris](https://www.ruby-forum.com/u/aris)\ **Post date:** [September 15, 2012, 1:52pm UTC](https://www.ruby-forum.com/t/re-post-add-optional-no-ca-option-to-ssl-verify-client-to-enable-app-only-ca-chain-validation/222936/1 "2012-09-15T13:52:44Z")
Re-post of patch from > **[Re: \[PATCH\] Add "pass\_only" option to ssl\_verify\_client to enable app-only...](https://forum.nginx.org/read.php?2,228761,229586#msg-229586)** > > Hello, Proposed patch enables use-case scenario when Nginx asks Client for TLS certificate but does not make any attempt to validate it, passing it to the application instead. Application itself if then free to decide whether provided certificate is... Updated version of the patch in the original thread haven’t received any new attention, it seems, and I’ve received several inquiries now about the status of this work, so this thread is basically an attempt to draw more attention to this patch. Use-case is the same as before - enable CA-chain validation in the application only - but with all non-CA-chain validation handled by nginx, so it won’t be necessary to duplicate (and possibly mess-up) these details (handled by openssl) in application code. For more details on reasoning behind the use-case and the previous comments on how it should be implemented, please see the original ‘[PATCH] Add “pass\_only” option to ssl\_verify\_client to enable app-only validation’ thread (linked for the web interface above). Notes from original thread on the latest patch incarnation: > Option is now called “optional\_no\_ca”, as suggested, and allows to check > all > certificate parameters except for a trust chain. I’ve used > ssl\_verify\_error\_is\_optional macro (listing trust-chain related errors) > directly > from apache 2.4.2 codebase. > Note that since ngx\_ssl\_get\_client\_verify now has to access configuration, > which > is accessible from ngx\_http\_request\_t, it wasn’t enough to pass > ngx\_connection\_t > to it, plus it was only used from ngx\_http\_ssl\_module.c, so I’ve moved > the > modified version of it into ngx\_http\_ssl\_module.c, to avoid having to > include > http-only stuff into ngx\_event\_openssl.c. If that was a bad idea, and > there’s a > need to keep that function generic (non-http-only), please suggest > whether > generic copy should just be kept in ngx\_event\_openssl.c, it’s signature > should > be extended to have http-specific options or maybe there should be > conditional > includes for http stuff. > URL for the patch: [https://raw.github.com/gist/3319062/](https://raw.github.com/gist/3319062/) (I’m not posting the patch inline here, because forum interface seem to break it anyway, but it can also be found inline in the original thread) Posted at Nginx Forum: > **[\[PATCH\] (re-post) Add "optional\_no\_ca" option to ssl\_verify\_client to enable...](https://forum.nginx.org/read.php?2,230748,230748#msg-230748)** > > Re-post of patch from http://forum.nginx.org/read.php?2,228761,229586#msg-229586 Updated version of the patch in the original thread haven't received any new attention, it seems, and I've received several inquiries now about the status of this work,... ---
**Author:** ![mk.fg](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/3ec8ea/32.png) [@mk.fg](https://www.ruby-forum.com/u/mk.fg)\ **Post date:** [September 15, 2012, 2:07pm UTC](https://www.ruby-forum.com/t/re-post-add-optional-no-ca-option-to-ssl-verify-client-to-enable-app-only-ca-chain-validation/222936/2 "2012-09-15T14:07:56Z")
bumping +1 required for [http://webid.info/](http://webid.info/) developed in W3C Community Group: [WebID Community Group](http://www.w3.org/community/webid/) Posted at Nginx Forum: > **[Re: \[PATCH\] (re-post) Add "optional\_no\_ca" option to ssl\_verify\_client to...](https://forum.nginx.org/read.php?2,230748,230749#msg-230749)** > > Re-post of patch from http://forum.nginx.org/read.php?2,228761,229586#msg-229586 Updated version of the patch in the original thread haven't received any new attention, it seems, and I've received several inquiries now about the status of this work,... ---
**Author:** ![mk.fg](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/3ec8ea/32.png) [@mk.fg](https://www.ruby-forum.com/u/mk.fg)\ **Post date:** [September 18, 2012, 9:44am UTC](https://www.ruby-forum.com/t/re-post-add-optional-no-ca-option-to-ssl-verify-client-to-enable-app-only-ca-chain-validation/222936/3 "2012-09-18T09:44:28Z")
Hello! On Sat, Sep 15, 2012 at 07:52:30AM -0400, mk.fg wrote: > (handled by openssl) in application code. > You may want to join discussion here, about the similar patch > submitted: > **[\[PATCH\] Add a no\_verify option for SSL client authentication](http://mailman.nginx.org/pipermail/nginx-devel/2012-August/002643.html)** In particular, I would like someone to actually test if the error\_page 495 aproach works instead as suggested here: > **[\[PATCH\] Add a no\_verify option for SSL client authentication](http://mailman.nginx.org/pipermail/nginx-devel/2012-August/002650.html)** And a quick comment for your patch: I tend to think that introduction of ngx\_http\_ssl\_variable\_get\_client\_verify() is misleading. We shouldn’t try to claim the certificate was verified unless it actually was. Maxim D.