Skip to content

Latest commit

 

History

History

nginx

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
conf
conf
 
 
imgs
imgs
 
 
.gitignore
.gitignore
 
 
Makefile
Makefile
 
 
README.md
README.md
 
 
docker-compose.yml
docker-compose.yml
 
 
wireshark.md
wireshark.md
 
 

README.md

* nginx_mtls-only-client1: CN=client1만 허용하는 mTLS nginx

개요

  • nginx mTLS

실습 준비

인증서 생성

  • Makefile에 정의된 certs job을 실행합니다.
make create-certs

nginx 컨테이너 실행

  • docker compose로 컨테이너 3개 실행
    • nginx_tls: tls통신하는 nginx
    • nginx_tls: mTLS통신하는 nginx
$ docker compose up -d
[+] Running 3/3
 ✔ Container nginx_mtls
 ✔ Container nginx_tls
 ✔ Container nginx_mtls-only-client1
docker compose ps

호출 테스트

TLS가 적용된 nginx 호출

  • 정상적으로 호출 됨
$ curl --resolve 'myserver.com:8880:127.0.0.1' https://myserver.com:8880 --cacert ./certs/ca.crt
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>

mTLS가 적용된 nginx 호출

  • 호출 실패
$ curl --resolve 'myserver.com:8881:127.0.0.1' https://myserver.com:8881 --cacert ./certs/ca.crt
<html>
<head><title>400 No required SSL certificate was sent</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<center>No required SSL certificate was sent</center>
<hr><center>nginx/1.27.4</center>
</body>
</html>

mTLS가 적용된 nginx를 호출하려면?

  • client1 클라이언트 인증서로 통신 성공
$ curl --cert ./certs/client1.crt --key ./certs/client1.key --cacert ./certs/ca.crt --resolve 'myserver.com:8881:127.0.0.1' https://myserver.com:8881
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
  • client2 클라이언트 인증서로 통신 성공
$ curl --cert ./certs/client2.crt --key ./certs/client2.key --cacert ./certs/ca.crt --resolve 'myserver.com:8881:127.0.0.1' https://myserver.com:8881
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>

mTLS가 적용된 nginx에 클라이언트 인증서 필터링

  • client1 인증서는 허용하고 client2 인증서는 거부

원리

  • 인증서 OU필드에 allowed일때만 허용
  • 파일링크
map $ssl_client_s_dn $client_allowed {
  default 0;
  ~OU=allowed 1;
}

실습

$ curl --cert ./certs/client1.crt --key ./certs/client1.key --cacert ./certs/ca.crt --resolve 'myserver.com:8882:127.0.0.1' https://myserver.com:8882
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
$ curl --cert ./certs/client2.crt --key ./certs/client2.key --cacert ./certs/ca.crt --resolve 'myserver.com:8882:127.0.0.1' https://myserver.com:8882
<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx/1.27.4</center>
</body>
</html>

더 볼거리

참고자료