Nginx代理与后端http的ssl双向认证

 

        ---可以实现后端http服务的真实ip的隐藏

把双向认证原客户端是的证书和密钥给代理nginx配置

在本机实现案例：

server {

        listen       0.0.0.0:80;

    access_log off;

        location / {

            proxy_set_header Host $host;

            proxy_set_header X-Real-IP $remote_addr;

            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

            proxy_redirect off;

            proxy_ssl_certificate   /etc/pki/CA/users/client.crt;

            proxy_ssl_certificate_key  /etc/pki/CA/users/client.key;

            proxy_pass https://127.0.0.1:443$request_uri;

测试：直接访问代理nginx服务器ip，便能直接访问到http服务，客户端不需要再认证