🔐 New 2025: How To Configure Mutual TLS (mTLS) for Secure nginx

Introduction

Mutual TLS (mTLS) ensures that both the client and server authenticate each other using certificates 🔑, significantly enhancing the security of communications. In this guide, we’ll walk through how to configure mTLS in Nginx in simple steps. Let’s dive in!

🔧 Step 1: Generate Certificates and Keys

To begin, you’ll need to create a Certificate Authority (CA) and sign both server and client certificates. We’ll use OpenSSL for this.

1.1 🚀 Generate the CA Certificate and Key

• Create the CA that will sign server and client certificates:
• Generate a self-signed Certificate Authority (CA) certificate and key

To generate the CA certificate, you can use the following OpenSSL commands:

openssl genpkey -algorithm RSA -out /path/to/ca.key
openssl req -new -x509 -key /path/to/ca.key -out /path/to/ca.cr

• 🗝️ ca.key: Private key of the CA
• 📜 ca.crt: Self-signed CA certificate valid for 365 days

1.2 🔐 Generate the Server Certificate and Key

• Now, generate the Nginx server certificate:

openssl genpkey -algorithm RSA -out /path/to/server.key
openssl req -new -key /path/to/server.key -out /path/to/server.csr
openssl x509 -req -in /path/to/server.csr -CA /path/to/ca.crt -CAkey /path/to/ca.key -CAcreateserial -out /path/to/server.crt

This creates:

• 🗝️ server.key: Server private key
• 📜 server.crt: Server certificate signed by the CA

1.3 🛡️ Generate the Client Certificate and Key

• For each client that will connect to the server, generate their key and certificate:

openssl genpkey -algorithm RSA -out /path/to/client.key
openssl req -new -key /path/to/client.key -out /path/to/client.csr
openssl x509 -req -in /path/to/client.csr -CA /path/to/ca.crt -CAkey /path/to/ca.key -CAcreateserial -out /path/to/client.crt

• 🗝️ client.key: Client private key
• 📜 client.crt: Client certificate signed by the CA

⚠️ Reminder: Replace /path/to/ with the actual file paths on your system.

⚙️ Step 2: Configure Nginx for SSL/TLS and mTLS

With the certificates in place, let’s configure Nginx to use them for SSL/TLS and enable mutual authentication (mTLS).

2.1 🖥️ Install and Start Nginx

• Ensure Nginx is installed and running:

sudo apt update && sudo apt install nginx   # On Ubuntu/Debian
sudo yum install nginx                     # On RHEL/CentOS

• Start and enable Nginx:

sudo systemctl start nginx
sudo systemctl enable nginx

2.2 🛠️ Configure Nginx for mTLS

• Edit your Nginx configuration (typically located at /etc/nginx/conf.d) to include SSL and mTLS settings.
• Place the CA certificate, server certificate, and key in a directory on the server.
• Place the client certificates and keys in a separate directory on the server.
• Configure Nginx to enable SSL/TLS and mTLS.

Here’s an example configuration file for Nginx to enable mTLS:

http {
 server {
 listen 443 ssl;
# Server certificate and key
 ssl_certificate /path/to/server.crt;
 ssl_certificate_key /path/to/server.key;
# CA certificate for client verification
 ssl_client_certificate /path/to/ca.crt;
 ssl_verify_client on;
location / {
 # Configure the backend server
 proxy_pass http://backend;
 }
 }
}

• 📜 ssl_certificate: Server certificate
• 🗝️ ssl_certificate_key: Server private key
• 📜 ssl_client_certificate: CA certificate to verify client certificates
• ✅ ssl_verify_client on: Enables client certificate verification

🛑 Don’t forget: Replace /path/to/ with the actual file paths.

Check your configuration with:

sudo nginx -t

Then restart Nginx to apply the changes:

sudo systemctl restart nginx

Please note that this is a basic configuration example, and you may need to modify it according to your specific requirements and environment. Additionally, you’ll need to follow appropriate security practices, such as securing the private keys and configuring proper access controls for the certificate and key files.

🔍 Step 3: Testing mTLS with cURL

• To test Nginx Mutual TLS (mTLS) using cURL, you can follow the steps below:

1. Execute the following cURL command, replacing the placeholders with your specific information:

curl - cert /path/to/client_certificate.pem - key /path/to/client_private_key.pem - cacert /path/to/ca_certificate.pem https://your_nginx_server
curl — cert /path/to/client_certificate.pem — key /path/to/client_private_key.pem — cacert /path/to/ca_certificate.pem https://your_nginx_server

• 📜 --cert: Path to the client certificate
• 🗝️ --key: Path to the client private key
• 📜 --cacert: Path to the CA certificate
• 🌐 https://your_nginx_server: The URL or IP of your Nginx server

Make sure to replace `/path/to/client_certificate.pem`, `/path/to/client_private_key.pem`, `/path/to/ca_certificate.pem`, and `https://your_nginx_server` with the actual paths and server information.

✅ If successful, cURL will establish a secure connection using mTLS.

🔐 Step 4: Verifying Check (Mutual TLS) Using the OpenSSL CLIENT

• To check mTLS (Mutual TLS) on an Nginx server using the OpenSSL command-line tool, you can follow these steps:

1. Ensure you have OpenSSL installed on your system. You can typically install it through your package manager or download it from the OpenSSL website.

2. Open a terminal or command prompt.

3. Execute the following command to establish an mTLS connection with the Nginx server and retrieve the server’s certificate:

```shell
openssl s_client -connect your_nginx_server:443 -cert /path/to/client_certificate.pem -key /path/to/client_private_key.pem -CAfile /path/to/ca_certificate.pem
```

• 🌐 your_nginx_server:443: Replace this with the hostname or IP address of your Nginx server along with the port number.
• 📜 -cert: Client certificate replace this with the path to the client certificate file.
• 🗝️ -key: Client private key Replace this with the path to the client private key file.
• 📜 -CAfile: CA certificate Replace this with the path to the CA (Certificate Authority) certificate file that signed the server’s certificate.

Make sure to replace the placeholders with the actual paths and server information.

💡 If the mTLS handshake is successful and the client certificate is valid, OpenSSL will output information about the server’s certificate. You can inspect the certificate details, such as the issuer, subject, validity period, and other attributes.

✅ Conclusion

🚨 Don’t miss out! 🚨

For a full in-depth comparison, check out the detailed exel sheet here :

https://www.benchhub.co/

🌟 It’s full of insights and everything you need to know! 📝✨

Configuring mutual TLS (mTLS) with Nginx enhances your security by requiring both client and server authentication 🔐. By following this guide, you can set up mTLS, verify the connection with cURL and OpenSSL, and follow best practices to ensure a robust and secure setup.