Commit 8c8f0e65 authored by Ondřej Borýsek's avatar Ondřej Borýsek
Browse files

Have TLS Client Auth off by default

parent 67434c75

README.md

+3 −3
Original line number Diff line number Diff line
@@ -16,11 +16,11 @@ The recommended deployment process is using Docker-compose. 
# MANUAL STEP: Fill in docker.env file (use .env.dist as a template)



# Setup TLS Client Auth:

# Option 1: Disable it

# Option 1: Keep it disabled.

    # touch nginx/trusted_client_certs.pem

    # sed -i 's/ssl_verify_client on;/ssl_verify_client off;/' nginx/nginx.conf

# Option 2: Set it up.

    # MANUAL STEP: create file nginx/trusted_client_certs.pem and put CA certificate(s) there

    # MANUAL STEP: create file nginx/trusted_client_certs.pem and put certificate(s) (CA or individual) there

    # sed -i 's/ssl_verify_client off;/ssl_verify_client on;/' nginx/nginx.conf



docker-compose up --build -d

```

nginx/nginx.conf

+1 −1
Original line number Diff line number Diff line
@@ -17,7 +17,7 @@ server { 
    ssl_certificate_key /etc/ssl/private/key.pem;

    ssl_password_file /etc/ssl/private/keys.pass;



    ssl_verify_client on; # on | off | optional | optional_no_ca;

    ssl_verify_client off; # on | off | optional | optional_no_ca;

    ssl_verify_depth 10;

    ssl_client_certificate /etc/ssl/certs/trusted_client_certs.pem;

    # note: The list of certificates will be sent to clients. If this is not desired, the ssl_trusted_certificate directive can be used.