客户端证书提示未显示 nginx

Question

我有一个 ca 证书包，试图在浏览器级别在 nginx 上集成客户端证书身份验证，但我无法收到要求发送证书以进行 ssl 身份验证的提示。我不确定这里遗漏了什么，在这方面的任何帮助将不胜感激。

下面是nginx的配置

    #
    # HTTPS server configuration
    #

    server {
        listen          10.0.111.118:8443;
        ssl         on;
            server_name     reverseproxy.in;

        ### SSL cert files ###
            ssl_certificate      conf.d/MonetServer.cer;
            ssl_certificate_key  conf.d/MonetServer.key;
            ssl_client_certificate      conf.d/Bundle.crt;



        ssl_verify_client on;

        server_tokens off; 
        access_log      logs/ssl/esmarts-access.log;
        error_log       logs/ssl/esmarts-error.log;
        proxy_set_header  Host $host;
        proxy_set_header  X-Real-IP $remote_addr;
        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header  X-Forwarded-Proto $scheme;
        proxy_set_header  X-Floof-SSL-Client-Serial $ssl_client_serial;
        proxy_set_header  X-Floof-SSL-Client-Verify $ssl_client_verify;






        ### We want full access to SSL via backend ###
            location / {
                proxy_pass  http://10.0.111.125:8080/esmart/index.html;

            ### force timeouts if one of backend is died ##
                proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;

            ### Set headers ####
                    proxy_set_header        Accept-Encoding   "";
                proxy_set_header        Host            $host;
                proxy_set_header        X-Real-IP       $remote_addr;
                proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-SSL-Client-S-DN   $ssl_client_cert;
            ### Most PHP, Python, Rails, Java App can use this header ###
            #proxy_set_header X-Forwarded-Proto https;##
            #This is better##
                proxy_set_header        X-Forwarded-Proto $scheme;
            add_header              Front-End-Https   on;


            ### By default we don't want to redirect it ####
                proxy_redirect     off;
          }

          location /esmart/VAADIN
           {

         proxy_pass  http://10.0.111.125:8080/esmart/VAADIN;

                    ### force timeouts if one of backend is died ##
                    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;

                    ### Set headers ####
                    proxy_set_header        Accept-Encoding   "";
                    proxy_set_header        Host            $host;
                    proxy_set_header        X-Real-IP       $remote_addr;
                    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-SSL-Client-S-DN   $ssl_client_cert;
                    ### Most PHP, Python, Rails, Java App can use this header ###
                    #proxy_set_header X-Forwarded-Proto https;##
                    #This is better##
                    proxy_set_header        X-Forwarded-Proto $scheme;
                    add_header              Front-End-Https   on;


                    ### By default we don't want to redirect it ####
                    proxy_redirect     off;
           }

          location /esmart/jsp
           {

         proxy_pass  http://10.0.111.125:8080/esmart/jsp;

                    ### force timeouts if one of backend is died ##
                    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;

                    ### Set headers ####
                    proxy_set_header        Accept-Encoding   "";
                    proxy_set_header        Host            $host;
                    proxy_set_header        X-Real-IP       $remote_addr;
                    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-SSL-Client-S-DN   $ssl_client_cert;


                    ### Most PHP, Python, Rails, Java App can use this header ###
                    #proxy_set_header X-Forwarded-Proto https;##
                    #This is better##
                    proxy_set_header        X-Forwarded-Proto $scheme;
                    add_header              Front-End-Https   on;


                    ### By default we don't want to redirect it ####
                    proxy_redirect     off;
           }


          location /esmart/APP
           {

         proxy_pass  http://10.0.111.125:8080/esmart/APP;

                    ### force timeouts if one of backend is died ##
                    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;

                    ### Set headers ####
                    proxy_set_header        Accept-Encoding   "";
                    proxy_set_header        Host            $host;
                    proxy_set_header        X-Real-IP       $remote_addr;
                    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-SSL-Client-S-DN   $ssl_client_cert;

                    ### Most PHP, Python, Rails, Java App can use this header ###
                    #proxy_set_header X-Forwarded-Proto https;##
                    #This is better##
                    proxy_set_header        X-Forwarded-Proto $scheme;
                    add_header              Front-End-Https   on;


                    ### By default we don't want to redirect it ####
                    proxy_redirect     off;
           }





      }

我一直收到错误

400 错误请求

未发送所需的 SSL 证书

已经在我的电脑上安装了客户端证书，这里的问题是我假设浏览器没有请求客户端上已经安装的客户端证书。

Answer 1

刚刚在这里发布了答案：https://serverfault.com/a/764509/344286

确保您可以使用 cURL 进行身份验证，以验证您的 nginx 设置是否正确。确认这一点后，您可以专注于生成 PKCS12 配置文件并将其安装到浏览器中。

Answer 2

我在使用 Chromium 时遇到了这个问题。看起来浏览器不要求非标准 https 端口（443 除外）上的客户端证书。调整配置以侦听端口 443 为我解决了问题。