nginx 双向证书配置 客户端证书验证

server {
listen       443 ssl;
# server_name  a.com;

index index.php index.html index.htm default.php default.htm default.html;
root /www/webrtc;

#ssl_certificate    /etc/nginx/cert/server.crt;
#ssl_certificate_key   /etc/nginx/cert/server.key;

#ssl_client_certificate /etc/nginx/cert/ca.crt;  # client公钥证书

ssl_certificate    /etc/nginx/cert/cert.pem;
ssl_certificate_key   /etc/nginx/cert/key.pem;
ssl_client_certificate /etc/nginx/cert/client.crt;  # client公钥证书
ssl_verify_client on;  # 开启客户端证书验证

ssl_session_cache    shared:SSL:1m;
ssl_session_timeout  5m;

ssl_ciphers  HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers  on;


access_log /var/log/nginx/webrtc/access.log;
error_log /var/log/nginx/webrtc/error.log;

location /api {
     proxy_set_header Host $host;
proxy_set_header  X-Real-IP        $remote_addr;
proxy_set_header  X-Forwarded-For  $proxy_add_x_forwarded_for;
proxy_set_header X-NginX-Proxy true;

rewrite ^/api/(.*)$ /$1 break;
proxy_pass http://127.0.0.1:8000;
#proxy_pass    http://127.0.0.1:8000;

}

}