Posts categorized under: Linux

Nginx, vhosts and client certificates

Using client certificates with multiples vhosts might show limitations.

If a deployment consists of:

• A first layer of Nginx reverse proxies, for TLS termination;
• Connected, with TLS client certificates, to a set of backend "application" servers;
• And the Host / SNI headers sent to the backend don't match that sent to …

Getting Firefox/Chrome to use system-wide certificates

While browsing the web, I was getting quite annoyed that firefox, chrome and console tools (wget, ...) each maintained a separate list of trusted certificates.

Which led me to dive into the arcane world of NSS, the "Network Security Services".