# This may be a dumb ssl question, but here goes **URL:** \ **Category:** NGINX\ **Created:** [October 10, 2012, 8:15pm UTC](https://www.ruby-forum.com/t/this-may-be-a-dumb-ssl-question-but-here-goes/223602 "2012-10-10T20:15:34Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![aris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/258eb7/32.png) [@aris](https://www.ruby-forum.com/u/aris)\ **Post date:** [October 10, 2012, 8:15pm UTC](https://www.ruby-forum.com/t/this-may-be-a-dumb-ssl-question-but-here-goes/223602/1 "2012-10-10T20:15:34Z")
Can I install and configure nginx to use a “public”/global CA’s SSL Certificate like Verisign, AND force (require) the use of client SSL certificates, AND allow those client/browser-certificates to be from a different CA/root? For example, openca or some self-signed setup that I use to just distribute client certificates to my registered users? Let me know if I am not asking the question correctly. Thanks, AJ ---
**Author:** ![AJ\_Weber](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8c91f0/32.png) [@AJ\_Weber](https://www.ruby-forum.com/u/AJ_Weber)\ **Post date:** [October 10, 2012, 11:17pm UTC](https://www.ruby-forum.com/t/this-may-be-a-dumb-ssl-question-but-here-goes/223602/2 "2012-10-10T23:17:25Z")
I think I might have found my answer to this. I can generate my own (or use any different) CA and add that in ssl\_client\_certificate ; And then set ssl\_verify\_client on; This appears to work in initial testing. So my follow-up is: 1. Does this sound like the way to make my original question work? 2. Can I revoke certificates, and will nginx check a revocation list of some kind? Thanks again, AJ ---
**Author:** ![AJ\_Weber](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8c91f0/32.png) [@AJ\_Weber](https://www.ruby-forum.com/u/AJ_Weber)\ **Post date:** [October 11, 2012, 12:52am UTC](https://www.ruby-forum.com/t/this-may-be-a-dumb-ssl-question-but-here-goes/223602/3 "2012-10-11T00:52:05Z")
Hello! On Wed, Oct 10, 2012 at 05:16:12PM -0400, AJ Weber wrote: > I think I might have found my answer to this. > > I can generate my own (or use any different) CA and add that in > ssl\_client\_certificate ; > And then set ssl\_verify\_client on; > > This appears to work in initial testing. So my follow-up is: > > 1. Does this sound like the way to make my original question work? Yes. > 1. Can I revoke certificates, and will nginx check a revocation list > of some kind? > **[Module ngx\_http\_oidc\_module](http://nginx.org/en/docs/http/ngx_http_oidc_module.html#ssl_crl)** > > The ngx\_http\_oidc\_module module (1.27.4) implements authentication as a Relying Party in OpenID Connect using the Authorization Code Flow. > > example, openca or some self-signed setup that I use to just > > [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > > [mailman.nginx.org archive](http://mailman.nginx.org/mailman/listinfo/nginx) – Maxim D. > **[F5 NGINX: Built for cloud-native apps. Ready for AI traffic.](https://www.f5.com/products/nginx)** > > Deliver modern applications with NGINX. Explore high-performance load balancing, API gateways, and web server solutions trusted by top global enterprises. ---
**Author:** ![AJ\_Weber](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8c91f0/32.png) [@AJ\_Weber](https://www.ruby-forum.com/u/AJ_Weber)\ **Post date:** [October 11, 2012, 5:36pm UTC](https://www.ruby-forum.com/t/this-may-be-a-dumb-ssl-question-but-here-goes/223602/4 "2012-10-11T17:36:37Z")
I didn’t double-check yet, but it looks like if I set this up, and the client does not have a client-side certificate, nginx is returning either a 400 (or more likely a 403)? Is there any way I can be entirely “rude” and re-map the return code if you do not have a client certificate to 444? Thanks again, AJ ---
**Author:** ![AJ\_Weber](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8c91f0/32.png) [@AJ\_Weber](https://www.ruby-forum.com/u/AJ_Weber)\ **Post date:** [October 11, 2012, 11:54pm UTC](https://www.ruby-forum.com/t/this-may-be-a-dumb-ssl-question-but-here-goes/223602/5 "2012-10-11T23:54:06Z")
Hello! On Thu, Oct 11, 2012 at 11:35:16AM -0400, AJ Weber wrote: > I didn’t double-check yet, but it looks like if I set this up, and > the client does not have a client-side certificate, nginx is > returning either a 400 (or more likely a 403)? Is there any way I > can be entirely “rude” and re-map the return code if you do not have > a client certificate to 444? The answer is on the very same page: > **[Module ngx\_http\_ssl\_module](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#errors)** > > The ngx\_http\_ssl\_module module provides the necessary support for HTTPS. – Maxim D. > **[F5 NGINX: Built for cloud-native apps. Ready for AI traffic.](https://www.f5.com/products/nginx)** > > Deliver modern applications with NGINX. Explore high-performance load balancing, API gateways, and web server solutions trusted by top global enterprises. ---
**Author:** ![AJ\_Weber](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8c91f0/32.png) [@AJ\_Weber](https://www.ruby-forum.com/u/AJ_Weber)\ **Post date:** [October 12, 2012, 12:08am UTC](https://www.ruby-forum.com/t/this-may-be-a-dumb-ssl-question-but-here-goes/223602/6 "2012-10-12T00:08:07Z")
I noticed that, but it appears to require a page / uri. I think the special 444 should not return content, if I am reading its design correctly. -Aaron ---
**Author:** ![AJ\_Weber](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8c91f0/32.png) [@AJ\_Weber](https://www.ruby-forum.com/u/AJ_Weber)\ **Post date:** [October 12, 2012, 12:22am UTC](https://www.ruby-forum.com/t/this-may-be-a-dumb-ssl-question-but-here-goes/223602/7 "2012-10-12T00:22:09Z")
Hello! On Thu, Oct 11, 2012 at 06:07:44PM -0400, Aaron wrote: > I noticed that, but it appears to require a page / uri. I think > the special 444 should not return content, if I am reading its > design correctly. This is because anything in nginx requires an uri. But it’s up to you to not return content for the uri, like this: ``` error_page 496 = /nocert; location = /nocert { return 444; } ``` See here for details: > **[Module ngx\_http\_core\_module](http://nginx.org/en/docs/http/ngx_http_core_module.html#error_page)** > > This directive appeared in version 1.11.8. > **[Module ngx\_http\_core\_module](http://nginx.org/en/docs/http/ngx_http_core_module.html#location)** > > This directive appeared in version 1.11.8. > **[Module ngx\_http\_rewrite\_module](http://nginx.org/en/docs/http/ngx_http_rewrite_module.html#return)** > > The ngx\_http\_rewrite\_module module is used to change request URI using PCRE regular expressions, return redirects, and conditionally select configurations. – Maxim D. > **[F5 NGINX: Built for cloud-native apps. Ready for AI traffic.](https://www.f5.com/products/nginx)** > > Deliver modern applications with NGINX. Explore high-performance load balancing, API gateways, and web server solutions trusted by top global enterprises. ---
**Author:** ![AJ\_Weber](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8c91f0/32.png) [@AJ\_Weber](https://www.ruby-forum.com/u/AJ_Weber)\ **Post date:** [October 11, 2012, 1:17am UTC](https://www.ruby-forum.com/t/this-may-be-a-dumb-ssl-question-but-here-goes/223602/8 "2012-10-11T01:17:13Z")
So far, I am loving nginx. 🙂 Thanks!