Nginx ssl_verify_client和proxy_pass

Question

我有2個Nginx服務器server1和server2。 server1需要客戶端ssl驗證。 服務器2代理的所有請求到Server1

的問題是當我試圖直接從Server1上的瀏覽器訪問我的服務要求我的客戶端證書，它工作正常

但從servier2它總是給錯誤「400錯誤的請求不需要SSL證書被送到」

server1的nginx的配置是

server { 
listen  443; 
server_name server1 ; 
ssl on; 
ssl_certificate /etc/nginx/ssl/server.crt; 
ssl_certificate_key /etc/nginx/ssl/server.key; 
ssl_client_certificate /etc/nginx/client_keys/keys.crt; 
ssl_verify_client on; 
ssl_verify_depth 1; 
ssl_session_timeout 5m; 
ssl_protocols SSLv3 TLSv1; 
ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP; 
ssl_prefer_server_ciphers on; 

location/{ 
    proxy_pass https://some-service; 
} 
} 

Server2上nginx的配置是

server { 
listen  443 default_server; 
server_name server2; 
ssl on; 
ssl_certificate /etc/nginx/ssl/server.crt; 
ssl_certificate_key /etc/nginx/ssl/server.key; 
ssl_client_certificate /etc/nginx/client_keys/keys.crt; 
location/{ 
    proxy_pass https://server1; 
} 
} 

Answer 1

目前，這在nginx中不被支持。但是有senginx [1]，它的代理模塊被擴展爲支持與原始服務器的客戶端證書握手。

[1] http://www.senginx.org/en/index.php/Proxy_HTTPS_Client_Certificate