I am developing a service for a client that based on their requirements needs to have client certificate based authentication.

They sent me 2 files, one is the certificate they will send in the request in .cer format, and the other is a ROOT CA file also in .cer format. Here are the file names:

  • CERT.cer
  • CA_ROOT.cer

I am trying to configure the access using nginx. Here is my configuration:

server {
  listen 443;
  server_name example.com;

  # SSL client certificate configuration
  ssl_client_certificate /etc/nginx/certs/CERT.cer;
  ssl_verify_client on;

  ssl_session_timeout 5m;

  ssl_protocols SSLv3 TLSv1;
  ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP;

  # serve assets or request page from proxy (if asset not found)
  location / {
    try_files $uri @proxy;

  # the play web server
  location @proxy {
    proxy_pass  http://localhost:9000;
    proxy_redirect off;
    proxy_buffering off;

Although I don't know how to test this without the private key. If I had the private key I could do something like this:

curl -v -s -k --key private.key --cert CERT.cer https://example.com

Is it even at all possible to do this without the private key file? (which I don't have)

Also, please let me know if I am doing something that I shouldn't, as in no way am I an expert on the security subject

  • You can look into certs: serverfault.com/questions/215606/…. On Nginx you can use some free cert like letsencrypt.org which is public chain so browers will understand it. So first would be to setup nginx ssl without user certs or certs you've been sent. Once you have that, you would use private chain for user certs. Here is example: arcweb.co/…. Curl needs root ca to verify the user cert (so it's full chain), inside user cert should be private key.
    – Aria
    Aug 8, 2016 at 23:54
  • It's bit complicated, so it's best to get it in two stages and test it with web browser. Web browser should have imported user cert with private key. On nginx there should be full ssl package from letsencrypt.org. To import user cert you can google how to import cer into it, as well how to convert it to pem format, as there are various formats and curl and browser might require different ones.
    – Aria
    Aug 8, 2016 at 23:57

2 Answers 2


This should be a comment, but its a bit long...

You seem to be missing a basic understanding of how ssl works. It is relatively simple to configure your own certificate authority and use that to produce server and client certificates/private keys, then you just need to swap in the appropriate files when you go into production.

Its straightforward but perhaps beyond the scope of a description here.

You've not said what the trust model is (specific client certs? Client certs signed by a specific CA? Specific common names signed by a range of CAs?). It's likely that you may have to tweak the openssl config.

Will you be running more conventional ssl off the same server? That adds a lot of complications and you might be better considering a secod installation of ssl to handle one of the 2 types of traffic (e.g. using stud).

The encryption you are using is considered insecure.

You can convert the format of the files using openssl from the comand line.

  • Yes, i am definitely missing basic understanding. I did a bunch of reading around security.stackexchange but I am still quite confused with the whole flow of things. Is it possible for me to only authenticate the client certificate? Without having a certificate on my server? Basically, is it possible to have client-only authentication instead of mutual auth? Aug 9, 2016 at 13:15
  • With only the certificate you can (in theory) configure your app to recognise the client when it connects, but you can't test this / experiment with it. Hence I'd suggest either getting hold of the corresponding private key, or get your own client cert and key. Ideally you want at least 2 client certs+keys to prove that its authenticating the desired certificate but not other certificates.
    – symcbean
    Aug 9, 2016 at 14:42

Is it even at all possible to do this without the private key file? (which I don't have)

You cannot issue a request with a client certificate if you don't have the private key. In fact the whole purpose of authentication with client certificate is to proof that you have the secret information, i.e. the private key.

But to test your setup you can create your own client certificate and use this in your setup. Once you have this running you can change your setup to check the certificates required by your customer. Please note that when testing you should not only test the case that the server accepts a client with the correct client certificate but also that it rejects a client without client certificate or with the wrong client certificate, even if issued by the same CA.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .