Howto: Custom if-CACERT check for SSL template in nginx?

[nielsh]

Hi there,

We want to include a certain directive in the nginx configuration for when users have the SSL CA Cert option enabled to include intermediate certificates. I have added the following:
|*if CACERT!=""|
ssl_trusted_certificate /usr/local/directadmin/data/users/|USER|/domains/|DOMAIN|.cacert;
|*endif|

to this file: /usr/local/directadmin/data/templates/custom/nginx_server_secure.conf + nginx_server_secure_sub.conf

Afterwards I did a rewrite of the httpd conf:
echo "action=rewrite&value=httpd" >> /usr/local/directadmin/data/task.queue
/usr/local/directadmin/dataskq d800

However it is never included in the nginx.conf file.

I do require the check because the .cacert file is only created when people actually enable this option in the control-panel, so otherwise nginx would give an error about the files not existing.

Does anyone have an idea?

Thanks!

 

[zEitEr]

Hello,

You should use/check CAROOT instead of CACERT.

By the way NGINX uses a combined cert file for the purpose.

ssl_certificate /usr/local/directadmin/data/users/userbob/domains/domain.com.cert.combined;

or shared:

/etc/httpd/conf/ssl.crt/server.crt.combined;

when a caroot is used.

Do you need ssl_trusted_certificate for ssl_stapling?

ssl_trusted_certificate specifies a file with trusted CA certificates in the PEM format used to verify client certificates and OCSP responses if ssl_stapling is enabled. In contrast to the certificate set by ssl_client_certificate, the list of these certificates will not be sent to clients.

http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_trusted_certificate