<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p> Hi,</p>
<p>I tried asking the following on the general mailing list but I'm
guessing this is tending more towards development.<br>
</p>
<p>I have a project that involves mutual / two way TLS and one of
the requirements is that the TLS handshake must fail ie. be
terminated before completion if the handshake is in anyway
unsuccessful, eg. no client certificate provided or client
certificate not trusted.</p>
<p>After having no success getting nginx (v1.16.1) & openssl
(v1.0.2k-fips) to fail the handshake I ended up looking at the
nginx source code, in particular src/event/ngx_event_openssl.c,
and from what I read here <a class="moz-txt-link-freetext"
href="https://www.openssl.org/docs/man1.0.2/man3/SSL_CTX_set_verify.html">https://www.openssl.org/docs/man1.0.2/man3/SSL_CTX_set_verify.html</a>
I think a small but necessary code change is required.<br>
</p>
<p>Some possible approaches when choosing to remain using nginx as
the server end of the mutual TLS connection<br>
</p>
<ul>
<li>in <b>static int ngx_ssl_verify_callback(int ok,
X509_STORE_CTX *x509_store)</b> make it configurable whether <b>1</b>
is always returned or the value of <b>ok</b></li>
<li>in <b>ngx_int_t ngx_ssl_client_certificate(ngx_conf_t *cf,
ngx_ssl_t *ssl, ngx_str_t *cert, ngx_int_t depth)</b> make it
configurable whether <b>SSL_CTX_set_verify(ssl->ctx,
SSL_VERIFY_PEER, ngx_ssl_verify_callback);</b> is called or <b>SSL_CTX_set_verify(ssl->ctx,
SSL_VERIFY_PEER, NULL);</b><br>
</li>
</ul>
<p>Is a code change required or is there a way for the handshake
failure to be 'enabled' as opposed to ending up with a
successfully established TLS connection. Admittedly within nginx
there's all the detail that the TLS connection doesn't conform to
the configured requirements of the TLS connection but this doesn't
satisfy the requirements for the project.</p>
<p>I won't bother going in to the details of the project but will
just say it's a third party certification body that requires the
TLS handshake to be terminated before completion if the handshake
is in anyway unsuccessful. We're currently looking at alternate
software but would really love to be able to pull this back in to
nginx when/if the day comes that nginx supports this.<br>
</p>
<p>Assuming development is required, is this something already on
the backlog? My only comment for enabling the TLS handshake
failure is it'd be really nice if it were configurable at the
level of the virtual host.<br>
</p>
<p>Regards,</p>
Phillip
</body>
</html>