3

I'm having trouble setting up a reverse proxy through nginx to a websocket application with client certificate authentication; so far I've gotten the server SSL cert to work no problem. Here are my steps so far for the client auth:

Create the client cert:

openssl req -new -x509 -days 365 -key ca.key -out ca.crt
openssl genrsa -out client.key 1024
openssl req -new -key client.key -out client.csr
openssl x509 -req -days 365 -in client.csr -CA ca.crt -CAkey \
  ca.key -set_serial 01 -out client.crt

Configure nginx:

daemon off;
events {
  worker_connections 4096;
}

http {
  map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
  }

  server {
    listen 443;
    ssl on;
    server_name rserve;

    ssl_certificate /etc/nginx/certs/server.crt;
    ssl_certificate_key /etc/nginx/certs/server.key;
    # ssl_client_certificate /etc/nginx/certs/ca.crt;
    # ssl_verify_client on;

    location / {
      proxy_pass http://localhost:8081;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
    }
  }
}

If I enable the ssl client stuff things stop working. On the client I'm using a jetty implementation (java), I import the client cert into a keystore with this line:

keytool -import -trustcacerts -keystore keystore.jks \
  -storepass changeit -noprompt -alias client -file client.crt

This procedure worked for a selfsigned server cert. The failure is reported on the client as a failure to switch protocols, this is in line with my previous failures on behalf of the SSL handshake - the proxied application is websocket only.

Lev Kuznetsov
  • 3,520
  • 5
  • 20
  • 33

1 Answers1

1

You created the private key outside of the keystore and have now imported just the certificate. The client application needs access to both the private and public parts.

Either import the private key or generate the certificate signing request using keytool rather than openssl.

Community
  • 1
  • 1
Richard Smith
  • 45,711
  • 6
  • 82
  • 81