Nginx + OpenSSL implement SSL two-way authentication

1. Purpose

2. SSL authentication mechanism

3. Use OpenSSL to generate a certificate

4. nginx publishes certificates to implement SSL two-way authentication

5. access the website using Ruby + client certificates

 

1. Purpose

Establish SSL two-way certificate authentication

Allows you to grant access permissions by IP address and by client certificate number.

 

2. SSL certificate authentication mechanism

Http://www.co.ccpit.org/ca/Htm/menu-item-frame2-content10.htm

Http://lulu87.blog.51cto.com/1244696/379556

 

3. Use OpenSSL to generate a certificate

Http://www.gaojinbo.com/openssl-%E7%94%9F%E6%88%90%E8%87%AA%E7%AD%BE%E8%AF%81%E4%B9%A6.html

Http://blog.jamiesun.me/archives/tag/nginx

 

4. nginx publishing implements SSL two-way authentication

1. Two-way Authentication + restrictions based on the certificate serial number

Server {Listen 8081; SERVER_NAME liuwm-pc@grandsoft.com.cn; # charset koi8-r; # access_log logs/host. Access. Log main; root D:/www-Date/public; location ^ ~ /1 {if ($ ssl_client_serial !~ * "9783a95824d433ec") {return 403 ;}# root D:/www-Date/public; # Allow 192.168.69.182; # deny all; # index index.html index.htm;} location ^ ~ /2 {if ($ ssl_client_serial !~ * "9783a95824d433ec") {return 403 ;}# root D:/www-date/public; # Allow 192.168.69.80; # deny all; # index index.html index.htm ;} location/{if ($ ssl_client_serial ~ * "9783a95824d433ec") {return 403;} # deny all; # Root D:/www-date/public; # index index.html index.htm;} # error_page 404/404 .html; # SSL on; ssl_certificate E:/nginx/nginx-1.1.7/SSL/server. CRT; ssl_certificate_key E:/nginx/nginx-1.1.7/SSL/server_no.key; ssl_client_certificate E:/nginx/nginx-1.1.7/SSL/CA. CRT; ssl_session_timeout 5 m; ssl_verify_client on; ssl_protocols SSLv2 SSLv3 tlsv1; ssl_ci Phers all :! ADH :! Export56: RC4 + RSA: + high: + medium: + low: + SSLv2: + exp; ssl_prefer_server_ciphers on; # redirect server error pages to the static page/50x.html # error_page 500 502 503 504/50 x.html; location =/50x.html {root HTML ;}

5. access the website with Ruby + client certificate