https://youtu.be/8DWcMbgQSZg or https://video.hardlimit.com/w/6oSkB4tL1KbuqoxgDistqR
(shown in the video but not described here)
- have a Linux server
- forward ports 80 and 443 of your Linux Server on your Router
- install Docker
- install Nginx Proxy Manager as a container
- set up and enable your host in Nginx Proxy Manager
- install GnuTLS certtool (
apt install gnutls-bin)
$ mkdir certs/
$ cd certs/Generate root CA key
$ openssl ecparam -genkey -name secp256r1 | openssl ec -out ca.keyCreate root CA certificate using generated key, will be valid for 10 years. It does not matter what you type in as an input.
$ openssl req -new -x509 -days 3650 -key ca.key -out ca.pemVariables
- client name - unique name for your client (ex. Smartphone)
- client serial - unique client ID number (ex. 01), increment it with each client creation
- challenge password - password used when importing the client certificate, can't be longer than 20 bytes
Generate client key
$ openssl ecparam -genkey -name secp256r1 | openssl ec -out <client name>.keyCreate client Certificate Signing Request (CSR)
$ openssl req -new -key <client name>.key -o <client name>.csrWhen asked:
- Keep common name the same as
<client name>. - Provide a
<challenge password>. - Leave the optional company name empty.
Generate client Certificate by signing client CSR with CA root. It will be valid for one year.
$ openssl x509 -req -days 365 -in <client name>.csr -CA ca.pem -CAkey ca.key -set_serial <client serial> -out <client name>.crtExport p12 bundle
$ certtool --load-privkey <client name>.key --load-certificate <client name>.crt --load-ca-certificate ca.pem --to-p12 --outder --outfile <client name>.p12 --p12-name "<client name>" --hash SHA1 --pkcs-cipher 3dec-pkcs12 --password <challenge password>Repeat that for each client you want to create incrementing <client serial> by one.
Variables
- ca path - path to mounted
ca.pemfile in your container.
Mount certs/ca.pem in your Nginx Proxy Manager container under <ca path>.
In the web interface navigate to your Proxied Host, click Edit, then Advanced.
In Custom Nginx Configuration add:
ssl_client_certificate <ca path>;
ssl_verify_client on;
Make sure you have Force SSL option enabled for your Host.
And save.
That's it :)
$ openssl req -new -key <client name>.key -out <client name>.csris the correct cmd, at least
$ openssl req -new -key <client name>.key -o <client name>.csrdid not work for me.
thanks for the guide!