server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name your_domain.com;
#----------------------------------------------------
## 1. Standard Server SSL Configuration
#----------------------------------------------------
# These are your server's public certificate and private key.
ssl_certificate /etc/nginx/ssl/your_domain.com.crt;
ssl_certificate_key /etc/nginx/ssl/your_domain.com.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-RSA-AES128-GCM-SHA256';
#----------------------------------------------------
## 2. Client Certificate Authentication
#----------------------------------------------------
# This is the Certificate Authority (CA) that signs your client certificates.
# Nginx will use this to verify the client's certificate.
ssl_client_certificate /etc/nginx/ssl/ca.crt;
# IMPORTANT: Set verification to 'optional'.
# This tells Nginx to request a certificate but not to fail the connection
# if one is not presented. The verification result is stored in a variable.
ssl_verify_client optional;
#----------------------------------------------------
## 3. API Location (No Certificate Required)
#----------------------------------------------------
# This location block handles all requests to /api/*.
# It does not check the client certificate status, so access is permitted.
location /api/ {
# The value of $ssl_client_verify is ignored here.
# Example: Proxy requests to your backend API service.
proxy_pass
http://127.0.0.1:8080
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
#----------------------------------------------------
## 4. Root Location (Certificate REQUIRED)
#----------------------------------------------------
# This location block handles requests to "/" and any other path not
# explicitly matched by another location block.
location / {
# Check the result of the client certificate verification.
# The $ssl_client_verify variable will be "SUCCESS" only if the client
# provided a valid certificate signed by the specified CA.
if ($ssl_client_verify != "SUCCESS") {
# If the certificate is missing or invalid, return 403 Forbidden.
return 403;
}
# If we reach this point, the client has been successfully authenticated.
# You can now serve your content or proxy to a backend.
# Example: Serve static files.
root /var/www/html_secure;
index index.html;
}
}
