<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<div>
<div>Wouldn't it be easier to parse and compare if the not before/after values were written as a UNIX timestamp instead of in human readable format? Just a thought :)<br>
<br>
<div class="acompli_signature"><br>
<br>
<br>
Kaj<br>
<br>
Sent from my iPad</div>
<br>
</div>
</div>
<div class="gmail_quote">_____________________________<br>
From: Andrey Kulikov <<a dir="ltr" href="mailto:amdeich@gmail.com" x-apple-data-detectors="true" x-apple-data-detectors-type="link" x-apple-data-detectors-result="1">amdeich@gmail.com</a>><br>
Sent: Monday, September 7, 2015 8:18 PM<br>
Subject: [PATCH] Add ssl_client_not_before and ssl_client_not_after request<br>
To: <<a dir="ltr" href="mailto:nginx-devel@nginx.org" x-apple-data-detectors="true" x-apple-data-detectors-type="link" x-apple-data-detectors-result="3">nginx-devel@nginx.org</a>><br>
<br>
<br>
<meta content="text/html; charset=utf-8">
<div dir="ltr">
<div>
<div>
<div>
<div>Hello, <br>
<br>
</div>
Nginx SSL module allow to use some variables: <a href="http://nginx.org/en/docs/http/ngx_http_ssl_module.html#variables">
http://nginx.org/en/docs/http/ngx_http_ssl_module.html#variables</a> <br>
</div>
But sometimes tey are not enough. <br>
<br>
</div>
Please find attached patch, adding two more: <br>
$ssl_client_not_before - Validity date from client certificate 'Not Before' <br>
$ssl_client_not_after - Validity date from client certificate 'Not After' <br>
<br>
</div>
After applying changes you may use them in configuration along with other variables:
<br>
<br>
location /test_headers/ { <br>
proxy_set_header X-ClientCert-SubjectSerial $ssl_client_serial; <br>
proxy_set_header X-ClientCert-NotBefore $ssl_client_not_before; <br>
proxy_set_header X-ClientCert-NotAfter $ssl_client_not_after; <br>
proxy_pass <a href="http://192.168.88.156/">http://192.168.88.156/</a>; <br>
} <br>
<br>
<div>And it will appears in (in this case) in proxied content in the following form:
<br>
<br>
X-ClientCert-SubjectSerial: 120005C82FBE782D06D89FF14800000005C82F <br>
X-ClientCert-NotBefore: Jul 9 22:20:31 2015 GMT <br>
X-ClientCert-NotAfter: Oct 9 22:30:31 2015 GMT <br>
<br>
<br>
</div>
<div>Tested on 1.8.0, tested that it can be cleanly applied to 1.9.4. <br>
<br>
</div>
<div>Feel free to ask any questions regarding this matter. <br>
<br>
</div>
<div>Best wishes, <br>
</div>
<div>Andrey <br>
</div>
</div>
<br>
<br>
</div>
</body>
</html>