ssl - 允许每个 ssl_verify 的 Nginx 问题，忽略的位置不起作用

Question

下面是我的 Nginx 配置

server {
       listen         80;
       server_name    acme.com;
       return         301 https://$server_name$request_uri;

}

server {
        listen   443 ssl;
        server_name             acme.com;

        #Server side certificates should be trusted certs.
        ssl_certificate         acme.com.crt;
        ssl_certificate_key     acme.com.key;

        #Client browser certificate identification can be trusted certs.
        ssl_client_certificate  /etc/ssl/acme/certs/ca.crt;
        ssl_crl                 /etc/ssl/acme/private/ca.crl;
        ssl_verify_client optional;
        ssl_verify_depth 5;

        ssl_session_timeout 5m;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers 'AES128+EECDH:AES128+EDH:!aNULL:!eNull:!EXPORT:!RC4:!DES:!SSLv2:!MD5!PSK';
        ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:10m;

        ssl_stapling on;
        ssl_stapling_verify on;

        add_header Strict-Transport-Security max-age=63072000;
        add_header X-Frame-Options DENY;
        add_header X-Content-Type-Options nosniff;

        root /usr/share/nginx/html;
        index index.php index.html index.htm;

        auth_basic            "Restricted Area";
        auth_basic_user_file  .htpasswd;


        location / {
            try_files $uri $uri/ /index.php?$args;
        }

        # pass the PHP scripts to FastCGI server listening on the php-fpm socket
        location ~ \.php$ {

            if ($ssl_client_verify != SUCCESS) {
                return 403;
            }

            try_files $uri $uri/ /index.php?$args;
            fastcgi_split_path_info ^(.+\.php)(/.+)$;
            fastcgi_pass unix:/var/run/php5-fpm.sock;
            fastcgi_index index.php;
            fastcgi_keep_conn on;
            fastcgi_param  DN $ssl_client_s_dn;
            fastcgi_param  DNi $ssl_client_i_dn;
            fastcgi_param  CERT_SERIALNO $ssl_client_serial;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            include fastcgi_params;
        }

        location /api/2/apps/corp.acme.exampleapp {
           if ($ssl_client_verify != SUCCESS) {
               return 200;
            }

            try_files $uri $uri/ /index.php?$args;
        }


        location /api/2/apps/corp.acme.anotherapp {
            if ($ssl_client_verify != SUCCESS) {
                return 200;
            }

            try_files $uri $uri/ /index.php?$args;
        }

        access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log debug;

        error_page 404 /404.html;
        error_page 500 502 503 504 /50x.html;

        location = /50x.html {
            root /usr/share/nginx/www;
        }

}

这是一切都变成梨形的地方。我不得不强制返回 200，因为设备上的下载客户端无法通过证书，因此该位被忽略。

/api/2/apps/corp.acme.exampleapp?format=plist HTTP/1.1" 200 0 "-" "itunesstored/1.0 iOS/8.3 model/iPhone7,1 build/12F70 (6; dt:107)"

==> /var/log/nginx/error.log <==
2015/05/05 13:01:05 [debug] 1561#0: *195 free: 0000000001262750, unused: 24
2015/05/05 13:01:05 [debug] 1561#0: *195 free: 0000000001231120, unused: 2780
2015/05/05 13:01:05 [debug] 1561#0: *195 free: 000000000123A000
2015/05/05 13:01:05 [debug] 1561#0: *195 hc free: 0000000000000000 0
2015/05/05 13:01:05 [debug] 1561#0: *195 hc busy: 0000000000000000 0
2015/05/05 13:01:05 [debug] 1561#0: *195 free: 0000000001244D30
2015/05/05 13:01:05 [debug] 1561#0: *195 tcp_nodelay
2015/05/05 13:01:05 [debug] 1561#0: *195 reusable connection: 1
2015/05/05 13:01:05 [debug] 1561#0: *195 event timer add: 6: 65000:1430830930999
2015/05/05 13:01:07 [debug] 1561#0: *195 post event 000000000127B890
2015/05/05 13:01:07 [debug] 1561#0: *195 delete posted event 000000000127B890
2015/05/05 13:01:07 [debug] 1561#0: *195 http keepalive handler
2015/05/05 13:01:07 [debug] 1561#0: *195 malloc: 000000000123A000:1024
2015/05/05 13:01:07 [debug] 1561#0: *195 SSL_read: 0
2015/05/05 13:01:07 [debug] 1561#0: *195 SSL_get_error: 5
2015/05/05 13:01:07 [debug] 1561#0: *195 peer shutdown SSL cleanly
2015/05/05 13:01:07 [info] 1561#0: *195 client 192.168.1.55 closed keepalive connection
2015/05/05 13:01:07 [debug] 1561#0: *195 close http connection: 6
2015/05/05 13:01:07 [debug] 1561#0: *195 SSL_shutdown: 1
2015/05/05 13:01:07 [debug] 1561#0: *195 event timer del: 6: 1430830930999
2015/05/05 13:01:07 [debug] 1561#0: *195 reusable connection: 0
2015/05/05 13:01:07 [debug] 1561#0: *195 free: 000000000123A000
2015/05/05 13:01:07 [debug] 1561#0: *195 free: 0000000000000000
2015/05/05 13:01:07 [debug] 1561#0: *195 free: 000000000122F8C0, unused: 0
2015/05/05 13:01:07 [debug] 1561#0: *195 free: 000000000122BFD0, unused: 32
2015/05/05 13:01:07 [debug] 1561#0: *195 free: 0000000001262140, unused: 144

Answer 1

这个问题归结为 Apple 如何加载 plist 的问题。

它不读取自签名证书，并且由于它们不在其钥匙串(keychain)中，因此失败。