<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div apple-content-edited="true" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hello,</div><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""></div><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Currently we’ve got the following situation in our production environment:</div>
</div>
<br class=""><div class="">Clients —HTTP—> Apache —HTTPS TWO-WAY SSL VIA PROXY —> HTTPS SERVERS</div><div class=""><br class=""></div><div class="">Just to be clear, the following services are used during this flow:</div><div class=""><br class=""></div><div class="">http client (firefox, chrome, curl, wget, etc.) —> Apache —> Squid —> HTTPS services of other parties on the internet, supporting two-way ssl</div><div class=""><br class=""></div><div class="">We’ve realized this using the following configuration on the apache service:</div><div class=""><br class=""></div><div class=""><div class="">LoadModule ssl_module modules/mod_ssl.so</div><div class=""><br class=""></div><div class="">Listen *:3128</div><div class=""><br class=""></div><div class=""><VirtualHost *:3128></div><div class=""><br class=""></div><div class=""> SSLProxyEngine On</div><div class=""> SSLProxyVerify require</div><div class=""> SSLProxyVerifyDepth 10</div><div class=""> SSLProxyMachineCertificateFile /etc/httpd/certs/client.pem</div><div class=""> SSLProxyCACertificateFile /etc/httpd/certs/ca.crt</div><div class=""><br class=""></div><div class=""> RewriteEngine On</div><div class=""> RewriteRule ^(.*)$ <a href="https://%{HTTP_HOST}$1" class="">https://%{HTTP_HOST}$1</a> [NC,P]</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""> ProxyPreserveHost On</div><div class=""> ProxyPass / <a href="https://$1/" class="">https://$1/</a></div><div class=""> ProxyPassReverse / <a href="https://$1/" class="">https://$1/</a></div><div class=""><br class=""></div><div class=""> ProxyRemote https <a href="http://192.168.68.102:3128" class="">http://192.168.68.102:3128</a></div><div class=""></VirtualHost></div></div><div class=""><br class=""></div><div class="">We’re trying to replace the apache service by using nginx. I’ve installed nginx 1.7.12 on CentOS 6.6 and have realized in a development environment a two-way ssl:</div><div class=""><br class=""></div><div class="">http client —> Nginx 1.7.12 —> https two-way ssl directly —> <a href="http://https.example.com" class="">https.example.com</a></div><div class=""><br class=""></div><div class=""><div class="">server {</div><div class=""> listen 3128;</div><div class=""> location / {</div><div class=""> #this enables client verification</div><div class=""> proxy_ssl_verify on;</div><div class=""> proxy_ssl_verify_depth 3;</div><div class=""><br class=""></div><div class=""> #client certificate for upstream server</div><div class=""> proxy_ssl_certificate /etc/nginx/certs/client.crt;</div><div class=""><br class=""></div><div class=""> #client key generated from upstream cert</div><div class=""> proxy_ssl_certificate_key /etc/nginx/certs/client.key;</div><div class=""><br class=""></div><div class=""> proxy_ssl_trusted_certificate /etc/nginx/certs/ca.crt;</div><div class=""><br class=""></div><div class=""> proxy_pass <a href="https://https.example.com:443/" class="">https://https.example.com:443/</a>; # Specifying "https" causes NGINX to</div><div class=""> # encrypt the traffic</div><div class=""> }</div><div class="">}</div></div><div class=""><br class=""></div><div class="">There are two thing I haven’t realized in the development environment, because I don’t know how:</div><div class="">1. Making the Nginx 1.7.12 to use a proxy system, because that’s our policy to communicate to the outside world.</div><div class="">2. Making the configuration variable as much as possible. So the Nginx 1.7.12 handles all different http client requests to different https servers and send them as a https two-way ssl. Currently it only handles request for <a href="http://https.example.com" class="">https.example.com</a>.</div><div class=""><br class=""></div><div class="">Any help is welcome.</div><div class=""><br class=""></div><div class="">Abdelouahed</div></body></html>