3 ms·
To verify client and server certificates. For certificate-based auth this is quite important, but it's also nice to, e.g., know that your server cert is not rev
by c0balt 2y ago
To verify client and server certificates. For certificate-based auth this is quite important, but it's also nice to, e.g., know that your server cert is not revoked.
- Asmod4n 2y agoYour client does the checking of the server cert, no need for any configuration server side. If you use certs for client auth it’s unlikely it’s used on the web and only in a company setting where you control the PCs, where you could just use something more suited for that case.
- eqvinox 2y agoIt's the client that is supposed to fetch the CRL. The server doesn't care unless it does client certificate authentication (which is incredibly rare due to poor UX.)
- hunter2_ 2y agoA server (nginx / httpd) might very well make outbound HTTPS calls and want to verify the origin's certificate to the fullest extent possible. This is known as a reverse proxy. However, many -- certainly not all -- reverse proxy configurations use origin servers that reside on the same exact network, and therefore don't need TLS connections (or use them with `SSLProxyVerify none` for e.g. self-signed certs to simplify things [0]), but I digress. [0] https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslproxyverify https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslpr...