# Using NGINX Reverse Proxy for client certificate authentication - start discussion

**URL:** <https://community.openhab.org/t/using-nginx-reverse-proxy-for-client-certificate-authentication-start-discussion/43064>\
**Category:** Tutorials & Examples\
**Created:** [April 3, 2018, 6:53pm UTC](https://community.openhab.org/t/using-nginx-reverse-proxy-for-client-certificate-authentication-start-discussion/43064 "2018-04-03T18:53:48Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![slawekjaranowski](https://community.openhab.org/user_avatar/community.openhab.org/slawekjaranowski/32/70784_2.png) [@slawekjaranowski](https://community.openhab.org/u/slawekjaranowski)\
**Post date:** [April 3, 2018, 6:53pm UTC](https://community.openhab.org/t/using-nginx-reverse-proxy-for-client-certificate-authentication-start-discussion/43064/1 "2018-04-03T18:53:48Z")

</div>

First we need install and configure Nginx according to page: [https://docs.openhab.org/installation/security.html](https://docs.openhab.org/installation/security.html)

To require client certificate we need two more options:

**ssl\_client\_certificate**  
**ssl\_verify\_client**

More info [Module ngx\_http\_ssl\_module](http://nginx.org/en/docs/http/ngx_http_ssl_module.html)

Now our configuraion can be as:

```
server {
    listen 80;
    server_name mydomain_or_myip;
    location / {
       return 301 https://$server_name$request_uri;
    }

    #### When using Let's Encrypt Only ####
    location /.well-known/acme-challenge/ {
        root /var/www/mydomain;
    }

}
server {
    listen 443 ssl;
    server_name mydomain_or_myip;

    ssl_certificate /etc/letsencrypt/live/mydomain/fullchain.pem; # or /etc/ssl/openhab.crt
    ssl_certificate_key /etc/letsencrypt/live/mydomain/privkey.pem; # or /etc/ssl/openhab.key
    
    ssl_client_certificate /etc/nginx/Client-CA.pem; # trusted CA used to issuing client certs
    ssl_verify_client on;
    
    add_header Strict-Transport-Security "max-age=31536000"; # Remove if using self-signed and are having trouble.

    location / {
        proxy_pass http://localhost:8080/;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        satisfy any;
        allow 192.168.0.1/24;
        allow 127.0.0.1;
        deny all;
        auth_basic "Username and Password Required";
        auth_basic_user_file /etc/nginx/.htpasswd;
    }
}

```

So configuring nginix for requireing client certificate is easy.

Now we need Client-CA.pem and certificates for each client.

There are many tutorials how to manage simple PKI.  
There are also many opensource software which support this.  
Some examples: [Public key infrastructure - Wikipedia](https://en.wikipedia.org/wiki/Public_key_infrastructure#Open_source_implementations)  
I use [X - Certificate and Key management](http://hohnstaedt.de/xca/) is very easy.

Last step is install client certificate in our device.  
In simply way we need pkcs#12 file with client certificate. We copy it to phone and we can instll it during OpenHub configurations.

So as we see it is not only nginx configurations, more works is with certificate management.

---

<div class="post-metadata">

**Author:** ![dastrix80](https://community.openhab.org/user_avatar/community.openhab.org/dastrix80/32/20582_2.png) [@dastrix80](https://community.openhab.org/u/dastrix80)\
**Post date:** [September 3, 2018, 4:44am UTC](https://community.openhab.org/t/using-nginx-reverse-proxy-for-client-certificate-authentication-start-discussion/43064/2 "2018-09-03T04:44:30Z")

</div>

Hi

Thanks, ive managed to get this working on my device.

thanks

---

<div class="post-metadata">

**Author:** ![Janestar](https://community.openhab.org/user_avatar/community.openhab.org/janestar/32/45407_2.png) [@Janestar](https://community.openhab.org/u/Janestar)\
**Post date:** [April 2, 2019, 8:55pm UTC](https://community.openhab.org/t/using-nginx-reverse-proxy-for-client-certificate-authentication-start-discussion/43064/4 "2019-04-02T20:55:21Z")

</div>

Many thanks for this tutorial Slawomir!  
Got everything running along with an SSL-Labs A rating of my OpenHAB installation at home.  
I think I am finally ready to migrate from Fibaro HC2 to OpenHAB.  
Cheers!

---

<div class="post-metadata">

**Author:** ![jswim788](https://community.openhab.org/user_avatar/community.openhab.org/jswim788/32/36341_2.png) [@jswim788](https://community.openhab.org/u/jswim788)\
**Post date:** [April 4, 2019, 4:27pm UTC](https://community.openhab.org/t/using-nginx-reverse-proxy-for-client-certificate-authentication-start-discussion/43064/5 "2019-04-04T16:27:16Z")

</div>

How does the Let’s Encrypt certbot renewal work with this? It doesn’t have the client certificate. Do you temporarily disable the client certificate to allow for renewal? Or use some other method?

Also, you also have auth\_basic enabled. Why is that? I thought the point of the client certificate validation is that you don’t need it. Or do you want another layer of protection?

Thanks

---

<div class="post-metadata">

**Author:** ![slawekjaranowski](https://community.openhab.org/user_avatar/community.openhab.org/slawekjaranowski/32/70784_2.png) [@slawekjaranowski](https://community.openhab.org/u/slawekjaranowski)\
**Post date:** [April 4, 2019, 6:26pm UTC](https://community.openhab.org/t/using-nginx-reverse-proxy-for-client-certificate-authentication-start-discussion/43064/6 "2019-04-04T18:26:29Z")

</div>

Let’s Encrypt use port 80 for domain validation, as we can read in certbot documentation.

We should well-nown location in server on port 80.

---

<div class="post-metadata">

**Author:** ![jswim788](https://community.openhab.org/user_avatar/community.openhab.org/jswim788/32/36341_2.png) [@jswim788](https://community.openhab.org/u/jswim788)\
**Post date:** [April 4, 2019, 6:54pm UTC](https://community.openhab.org/t/using-nginx-reverse-proxy-for-client-certificate-authentication-start-discussion/43064/7 "2019-04-04T18:54:37Z")

</div>

The example in the openHAB docs [here](https://www.openhab.org/docs/installation/security.html) has a redirect to the https port. Doesn’t that include the certbot domain validation? Wouldn’t that have a problem for the acme challenge? Or do you have the port 80 block configured differently than this example?

```auto
server {
    listen 80;
    server_name mydomain_or_myip;
    return 301 https://$server_name$request_uri;
}

```

---

<div class="post-metadata">

**Author:** ![slawekjaranowski](https://community.openhab.org/user_avatar/community.openhab.org/slawekjaranowski/32/70784_2.png) [@slawekjaranowski](https://community.openhab.org/u/slawekjaranowski)\
**Post date:** [April 4, 2019, 8:45pm UTC](https://community.openhab.org/t/using-nginx-reverse-proxy-for-client-certificate-authentication-start-discussion/43064/8 "2019-04-04T20:45:58Z")

</div>

According to ACME specification Let’s Encrypt, use port 80 for HTTP-01 challenge.

Probably Let’s Encrypt work ok because follow redirect, so both configuration will be ok.

In this post question was, how to work with Let’s Encrypt and client certificate. So we simply use port 80 for Let’s Encrypt and port 443 for our rest comunication.

More:

> **[Best Practice - Keep Port 80 Open](https://letsencrypt.org/docs/allow-port-80/)**
>
> We occasionally get reports from people who have trouble using the HTTP-01 challenge type because they’ve firewalled off port 80 to their web server. Our recommendation is that all servers meant for general web use should offer both HTTP on port 80...

> <https://github.com/ietf-wg-acme/acme/blob/master/draft-ietf-acme-acme.md>

---

<div class="post-metadata">

**Author:** ![jswim788](https://community.openhab.org/user_avatar/community.openhab.org/jswim788/32/36341_2.png) [@jswim788](https://community.openhab.org/u/jswim788)\
**Post date:** [April 12, 2019, 10:18pm UTC](https://community.openhab.org/t/using-nginx-reverse-proxy-for-client-certificate-authentication-start-discussion/43064/9 "2019-04-12T22:18:00Z")

</div>

Sorry, I misread the original post and somehow thought the acme-challenge was in the original place. I agree that it will work where it is. And I agree that port 80 should be open. But even the page you quoted says all port 80 requests should be redirected to port 443. Anyway, I was thinking that something like this might work in the 443 server. Make the authentication be optional, and check it in the / block. There is no check for the acme-challenge location.

```auto
    # client certificate
    ssl_client_certificate /etc/nginx/client_certs/ca.crt;
    ssl_verify_client optional;

    location / {
      # if the client-side certificate failed to authenticate, show a 403
      # message to the client
      if ($ssl_client_verify != SUCCESS) {
        return 403;
      }

```

Any comments on this? I know “if” has a bad reputation with nginx, but they do seem say this usage type is okay. Maybe this is no better than the original.

Also, I am curious as to why you use basic authentication as well as the client certificate. Just for extra security?

thanks

---

<div class="post-metadata">

**Author:** ![Nizar\_Elouaer](https://community.openhab.org/user_avatar/community.openhab.org/nizar_elouaer/32/55061_2.png) [@Nizar\_Elouaer](https://community.openhab.org/u/Nizar_Elouaer)\
**Post date:** [June 14, 2020, 11:31pm UTC](https://community.openhab.org/t/using-nginx-reverse-proxy-for-client-certificate-authentication-start-discussion/43064/10 "2020-06-14T23:31:09Z")

</div>

Hello, thank you for the post. I am actually having a blocking problem. I configured my nginx server to use self signed certificates and added the virtual server to handle my clients https requests. However I would like to allow only a list of known clients to call my endpoints. I have the clients certificates and I imported to my Ubuntu. However when I add my client crt certificate to the ssl\_client\_certificate, restar my nginx and try to access using the pfx Client certificate I am having a 400 bad request. Any idea ? Thank you