Nginx ssl_verify_client和proxy_pass

Question

我有2个Nginx服务器server1和server2。 server1需要客户端ssl验证。 服务器2代理的所有请求到Server1

的问题是当我试图直接从Server1上的浏览器访问我的服务要求我的客户端证书，它工作正常

但从servier2它总是给错误“400错误的请求不需要SSL证书被送到”

server1的nginx的配置是

server { 
listen  443; 
server_name server1 ; 
ssl on; 
ssl_certificate /etc/nginx/ssl/server.crt; 
ssl_certificate_key /etc/nginx/ssl/server.key; 
ssl_client_certificate /etc/nginx/client_keys/keys.crt; 
ssl_verify_client on; 
ssl_verify_depth 1; 
ssl_session_timeout 5m; 
ssl_protocols SSLv3 TLSv1; 
ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP; 
ssl_prefer_server_ciphers on; 

location/{ 
    proxy_pass https://some-service; 
} 
} 

Server2上nginx的配置是

server { 
listen  443 default_server; 
server_name server2; 
ssl on; 
ssl_certificate /etc/nginx/ssl/server.crt; 
ssl_certificate_key /etc/nginx/ssl/server.key; 
ssl_client_certificate /etc/nginx/client_keys/keys.crt; 
location/{ 
    proxy_pass https://server1; 
} 
} 

Answer 1

目前，这在nginx中不被支持。但是有senginx [1]，它的代理模块被扩展为支持与原始服务器的客户端证书握手。

[1] http://www.senginx.org/en/index.php/Proxy_HTTPS_Client_Certificate