nginx https reverse proxy with client certificate. Inbox x

All,

I am trying to use NGINX as reverse proxy for https backend servers


Client <-------> NGINX <-------> backend

NGINX proxy accepts only ssl connections on 443

Proxy's NGINX conf:

http {
server {
listen 443;
ssl on;
include snippets/self-signed.conf;
include snippets/ssl-params.conf;
# client certificate
ssl_client_certificate /etc/nginx/client_certs/ca.crt;

ssl_verify_client optional;

location / {
if ($ssl_client_verify != SUCCESS) {
return 403;
}
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#proxy_set_header Host $http_host;
add_header Front-End-Https on;
if ($host = 'secure_backend' ) {
proxy_pass https://https_backend:443;
}

if ($host = 'backend' ) {
proxy_pass http://http_backend;
}

proxy_redirect off;
proxy_ssl_verify off;
add_header Front-End-Https on;
proxy_cache off;

proxy_http_version 1.1;
proxy_read_timeout 90;
} # /location /
}

I can succefully:

http://backend (client authenticated with proxy and passed using http to backend)

http://secure_backend (client authenticated with proxy and passed using https to https_backend)


However I am unable to:

https://secure_backend

access log:
CONNECThttps_backend:443 HTTP/1.1" 400 182 "-" "-"

error log:
2018/06/03 18:32:22 [warn] 754#754: "ssl_stapling" ignored, issuer certificate not found
2018/06/03 18:32:27 [warn] 920#920: "ssl_stapling" ignored, issuer certificate not found
2018/06/03 18:32:27 [debug] 923#923: epoll add event: fd:8 op:1 ev:00002001
2018/06/03 18:32:27 [debug] 923#923: epoll add event: fd:10 op:1 ev:00002001


Any Ideads are appreciated.

BR
Itamar