Startcom issues client certs. I'm using mine for seamless authentication in nginx as follows, in somewhat the same manner as was suggested by this Q/A:

server {
    ssl_certificate /path/to/my/webserver.crt;
    ssl_certificate_key /path/to/my/webserver.key;

    # concatenated Startcom ca-bundle.pem and sub.class1.client.ca.pem
    ssl_client_certificate /path/to/combined.pem;

    # die unless the client is authenticated
    ssl_verify_client on;

    # look in intermediate and root
    ssl_verify_depth 2;

    # where email@example.com in the following was gotten by unpacking the startcom .p12 file thusly,
    #     openssl pkcs12 -in email@example.com.p12 -out email@example.com.pem -nodes -nokeys
    # then removing the root and intermediate from that pem, and running this against the remaining client certificate:
    #     openssl x509 -noout -in email@example.com.pem -subject                           

    if ($ssl_client_s_dn != "/CN/email@example.com/emailAddress=email@example.com")
           return 403;


So I want to know if I correctly understand that the above verifies

  1. my client certificate to startcom and
  2. the subject email address matches my associated account.

And if those things are true, is that sufficient to let only me be authenticated?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.