nginx - reverse proxy certificate authentication

Question

I´m trying to use nginx as a reverse proxy to an internal webserver running Tomcat, which hosts a front-end to our ERP system.

It is already working fine: I can perfectly connect to the nginx server (which is locked up on our network, different VLAN, firewall, etc etc etc) and then reverse proxy to my ERP server.

However, I want do add an extra layer of protection, by requiring users to have a digital certificate on their computer, so they can access the first (nginx) server. The certificate is not used/necessary to the back-end server.

I´ve been through this tutorial http://nategood.com/client-side-certificate-authentication-in-ngi which allowed me to generate my self-signed certificates and everything else.

When using ssl_verify_client optional on nginx configuration, I can connect normally to my back-end server, but no certificate is asked/required.

When I switch it to ssl_verify_client on , all access are then blocked by a

400 Bad Request No required SSL certificate was sent 

No matter which browser I am using (Chrome, IE, Edge, Firefox). Of course I´ve put all certificates/chain on my client computer, but no certificate is asked on any browsers. What I am missing?

Here is my full nginx config:

server { listen 443; ssl on; server_name 103vportal; ssl_password_file /etc/nginx/certs/senha.txt; ssl_certificate /etc/nginx/certs/server.crt; ssl_certificate_key /etc/nginx/certs/server.key; ssl_client_certificate /etc/nginx/certs/ca.crt; ssl_verify_client on; location / { proxy_pass http://10.3.0.244:16030; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_read_timeout 300; proxy_send_timeout 300; } } 

Answer 1

This answer worked for me:

https://stackoverflow.com/questions/41933654/nginx-reverse-proxy-certificate-authentication

The trick was to create a personal certificate (via the provided command) and use the hostname/DNS combo under the certificate.