SystemSh0cker/gocsaf
1
0
Fork 0
mirror of https://github.com/gocsaf/csaf.git synced 2025-12-22 11:55:40 +01:00
Code Issues Releases Activity Actions

Improve client cert setup instructions

Browse source 
* Rephrase slightly and add hint that the issuer config
   will be checked against the `$ssl_client_i_dn` variable, so the
   example serves both uses.

resolve #46
This commit is contained in:
Bernhard Reiter 2022-04-13 11:53:21 +02:00
parent 8711ea67fe
commit f04473874a
No known key found for this signature in database
GPG key ID: 2B7BA3BF9BC3A554
1 changed files with 9 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/client-certificate-setup.md
View file

@ -37,8 +37,15 @@ differently, you could use several location blocks
each which a single `if` that matches the `$ssl_client_i_dn` variable
to CAs that you would want to allow for that location.
If you want to restrict the writing permission and the accessing to the web-interface of the `csaf_provider` to only some TLS client certificates, the CA issuer of these certificates should be assigned to the `issuer` config option in the `/user/lib/csaf/config.toml` file e.g. `issuer = "C=DE,O=CSAF Tools Development (internal),CN=Tester" `.
To inspect the accepted format for this field you can check the value of the `ca:` in the nginx log file `/var/log/nginx/error.log`.
If you want to restrict the writing permission and access to the web-interface
of the `csaf_provider` to only some TLS client certificates,
the CA issuer of these certificates should be assigned to the `issuer`
config option in the `/user/lib/csaf/config.toml` file
e.g. `issuer = "C=DE,O=CSAF Tools Development (internal),CN=Tester" `.
The value will be checked against the `$ssl_client_i_dn` variable
within the `csaf_provider`.
To inspect the precise string of certain certificate, try it and
check the logged value in the nginx log file, e.g. `/var/log/nginx/error.log`.
Reload or restart nginx to apply the changes (e.g. `systemctl reload nginx`
on Debian or Ubuntu.)