Nginx Dogu supports client authentication using certificates (Mutual TLS). When this feature is enabled,\nNginx requests a certificate from the client during the TLS handshake and validates it against a stored\nCertificate Authority (CA).
\nThe configuration is done via the Dogu configuration mutual_tls/enabled.
\n\n[!IMPORTANT]
\n
\nSplit DNS must be configured for authentication with client certificates to work.\nSee Split DNS
In order for Nginx to validate the client certificates, the public certificate of the CA must be known globally in the CES.\nThe CA certificate must be stored in PEM format in the global configuration:
\ncat client-ca.crt | etcdctl set /config/_global/certificate/client-ca.crt\n\nNote: A CA certificate can be generated as follows, for example:
\n\n
\n- Generate key:
\nopenssl genrsa -out client-ca.key 4096- Create certificate:
\nopenssl req -x509 -new -nodes -key client-ca.key -sha256 -days 3650 -out client-ca.crt -subj "/C=DE/O=MyOrg/CN=MyOrg Client Root CA
Client authentication is disabled by default. It can be enabled via the Dogu config of nginx:
\netcdctl set /config/nginx/mutual_tls/enabled trueAfter making this change, the Nginx Dogu must be restarted so that the CA certificate is loaded from the registry and the\nconfiguration is regenerated.
\nOnce mutual_tls/enabled is set to true:
startup.sh script extracts the CA certificate from the global registry to /etc/ssl/client-ca.crt.ssl.conf activates the Nginx directives ssl_client_certificate and ssl_verify_client on.To enable Dogus to send requests to other Dogus without a client certificate (e.g., to validate the CAS session),\nan exception is created in nginx.conf for all requests originating from the internal Docker network (172.18.0.1/32).
For this to work, split DNS must be configured accordingly.\nWhen installing the CES, this can be configured in setup.json under useInternalIp or internalIp. See: https://docs.cloudogu.com/de/docs/system-components/ces-setup/operations/setup-json/#useinternalip
This creates a corresponding entry in the /etc/hosts of the CES instance.\nTo configure a CES instance for split DNS after installation, a corresponding entry must be stored in /etc/hosts for the internal IP.\nFor example:
<internal IP> <DNS name>\n172.18.0.1 ces.example.comAfter that, all Dogus must be restarted once.
\nThe following steps are necessary to generate a client certificate:
\nopenssl genrsa -out client1.key 4096openssl req -new -key client1.key -out client1.csr -subj “/C=DE/O=MyOrg/OU=Clients/CN=client1”Generate client extension file:
\n cat > client.ext <<‘EOF’\n basicConstraints = CA:FALSE\n keyUsage = digitalSignature, keyEncipherment\n extendedKeyUsage = clientAuth\n subjectKeyIdentifier = hash\n EOFopenssl x509 -req -in client1.csr -CA client-ca.crt -CAkey client-ca.key -CAcreateserial -out client1.crt -days 365 -sha256 -extfile client.extExport client certificate: openssl pkcs12 -export -inkey client1.key -in client1.crt -certfile client-ca.crt -name “client1” -out client1.p12
\n\nNote: A password must be entered when exporting.
\n
The exported certificate can now be imported into the browser.
","frontmatter":{"title":"","canonical":null},"fields":{"folders":["dogus","nginx","dev"],"delocalizedSlug":"/docs/dogus/nginx/dev/client-certificates/","title":"Mutual TLS with client certificates","pageType":"docs"},"tableOfContents":"Mutual TLS with client certificates
\nException for internal Dogu requests
\n