ssl certificate – Nginx configuration for 2 way mutual SSL?

I have looked at all the previous NGINX 2 way mutual SSL questions and I dont see the answer to this:

How do I specify what my server’s certificate is for 2 way mutual SSL in NGINX?

I have 2 certificates:

1: the domain’s certificate “api.mysite.com” to allow HTTPS traffic. CA is Comodo.

2: the client cert that I need to send to the other site, “mysite.client.crt”, self signed.

The other side has only 1 certificate:
the client cert they need to send to me, “othersite.client.crt”, self signed (by them)

My site is the server, the other site is making all the calls to me. I never call them.

I don’t see in the docs the correct way to send “mysite.client.crt”

All .pem files are just the cert plus the CA cert.

My nginx config is:

server {
server_name  api.mysite.com;
listen 443 ssl;

# this is the domain cert - to allow HTTPS only
# not to be used as the client cert

ssl_certificate /etc/ssl/mysite/api.mysite.com.pem;
ssl_certificate_key /etc/ssl/mysite/api.mysite.com.key;

#
# Where do I add mysite.client.pem in the config?
# Cannot find any documentation for this part
#

ssl_protocols TLSv1.2;

# this is the other sides client cert

ssl_verify_client on;
ssl_client_certificate /etc/ssl/othersite/othersite.client.pem;
ssl_verify_depth 2;
}

Where in the above config do I add “mysite.client.pem”?

Note that I don’t want to use my domain cert as the client cert – that does not feel right.

enter image description here

My server is running Node js / Express on linux. The other side is Java Spring on linux. But this shouldn’t make a difference to the nginx config.

Read more here: Source link