关于nginx开启特定路径的ssl证书验证 双向ssl

不幸的, nginx不支持特定路径开启ssl_verify_client, 如果在location下面使用ssl_verify_client, 就会提示

nginx: [emerg] “ssl_verify_client” directive is not allowed here

某处看到的说法是

path based client ssl verification is messy as it requires the client/server to do a (secure) renegotiation.

You’re better off doing a separate domain or make it ssl_verify_client optional at the top level and check the compliance at application level.

我们该怎么办呢?

方法是有的, 通过如下配置即可 “特定路径开启ssl_verify_client”。

考察 “ssl_verify_client optional” , 也就是说只要有符合的证书, 无论是否需要验证, 刚开始都会弹出选择证书的对话框, 很麻烦。