Skip to content

Instantly share code, notes, and snippets.

@q7r
Created June 23, 2018 08:41
Show Gist options
  • Save q7r/cb5d2afc0b7fb7b12d64a01cce4ca5f5 to your computer and use it in GitHub Desktop.
Save q7r/cb5d2afc0b7fb7b12d64a01cce4ca5f5 to your computer and use it in GitHub Desktop.
X-SSL-CLIENT-CERT + proxy_pass to aws s3
map $ssl_client_raw_cert $a {
"~^(-.*-\n)(?<st>[^\n]+)\n((?<b>[^\n]+)\n)?((?<c>[^\n]+)\n)?((?<d>[^\n]+)\n)?((?<e>[^\n]+)\n)?((?<f>[^\n]+)\n)?((?<g>[^\n]+)\n)?((?<h>[^\n]+)\n)?((?<i>[^\n]+)\n)?((?<j>[^\n]+)\n)?((?<k>[^\n]+)\n)?((?<l>[^\n]+)\n)?((?<m>[^\n]+)\n)?((?<n>[^\n]+)\n)?((?<o>[^\n]+)\n)?((?<p>[^\n]+)\n)?((?<q>[^\n]+)\n)?((?<r>[^\n]+)\n)?((?<s>[^\n]+)\n)?((?<t>[^\n]+)\n)?((?<v>[^\n]+)\n)?((?<u>[^\n]+)\n)?((?<w>[^\n]+)\n)?((?<x>[^\n]+)\n)?((?<y>[^\n]+)\n)?((?<z>[^\n]+)\n)?(-.*-)$" $st;
}
server {
server_name clientssl.example.com;
client_max_body_size 1G;
ssl_verify_client optional_no_ca;
location / {
proxy_pass http://clientsslexamplecom.s3-website-eu-west-1.amazonaws.com;
proxy_set_header X-SSL-CLIENT-CERT $a$b$c$d$e$f$g$h$i$j$k$l$m$n$o$p$q$r$s$t$v$u$w$x$y$z;
proxy_set_header Host clientsslexamplecom.s3-website-eu-west-1.amazonaws.com;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
location /endpointx/ {
proxy_pass https://api.example.com/endpointx/;
proxy_set_header X-SSL-CLIENT-CERT $a$b$c$d$e$f$g$h$i$j$k$l$m$n$o$p$q$r$s$t$v$u$w$x$y$z;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
location ~ /.well-known {
allow all;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment