30. Nginx. Prueba de certificados. Aceptar certificados de usuario de varias CAs

A. Crear CA y certificados de prueba 

1. Crear carpeta de trabajo

#1. Crear carpetra de certificados
cd MyCerts
mkdir 2024
cd 2024

2. Crear clave de la CA y damos de password "mi-clave"

#2. Crear clave de la CA
openssl genpkey -algorithm RSA -out ca.key -aes256

3. Crear el certificado de la CA en formato PEM y le damos información varia

#3. Crear certificado de la CA
openssl req -x509 -new -nodes -key myCA.key -sha256 -days 1826 -out myCA.pem

4. Crear  la clave y el CSR de servidor web (OJO NO HACERLA AES256 que nginx falla!!!)

#4. Crear la clave del servidor WEB

openssl genrsa -out webserver.key 4096

#4. Crear CSR de servidor WEB
openssl req -new -key webserver.key -out webserver.csr

5. Extraer las IPs i  los DNS 

#5. IPS y DNS del srvidor
ifconfig

nslookup 192.168.1.2

Siendo 192.168.1.2 la IP del webserver obtenida ejecutando en el el comando if config. El comando nslooup devuelve

2.1.168.192.in-addr.arpa name = edu-HP-ProDesk-600-G1-SFF.

2.1.168.192.in-addr.arpa name = edu-HP-ProDesk-600-G1-SFF.local.

6. Crear el fichero webserver.v3.ext con esta información

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = edu-HP-ProDesk-600-G1-SFF
DNS.2 = edu-HP-ProDesk-600-G1-SFF.local
IP.1 = 192.168.1.2

IP.2  = 192.168.1.2

7. Firmar el certificado de servidor

#7. Crear certificado de servidor WEB

openssl x509 -req -in webserver.csr -CA myCA.pem -CAkey myCA.key -CAcreateserial -out webserver.crt -days 730 -sha256 -extfile webserver.v3.ext

8. Crear la clave y el CSR de usuario

#8. Crear clave de cliente

openssl genpkey -algorithm RSA -out client.key -aes256

#8. Crear CSR de cliente
openssl req -new -key client.key -out client.csr

9. Firmar el certificado de usuario

#9. firmar certificado de cliente

openssl x509 -req -in client.csr -CA myCA.pem -CAkey myCA.key -CAcreateserial -out client.crt -days 365 -sha256

B. Crear fichero de configuración de nginx

10. Fichero /etc/nginx/sites-enabled/default  de nginx

upstream odoo {
  server 127.0.0.1:8069;
}

upstream odoochat {
  server 127.0.0.1:8072;
}

server {
  listen 80;
  server_name odoo.example.com;
  proxy_read_timeout 720s;
  proxy_connect_timeout 720s;
  proxy_send_timeout 720s;

  # Add Headers for odoo proxy mode
  proxy_set_header X-Forwarded-Host $host;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;
  proxy_set_header X-Real-IP $remote_addr;

  # log
  access_log /var/log/nginx/odoo.access.log;
  error_log /var/log/nginx/odoo.error.log;

  # Redirect longpoll requests to odoo longpolling port
  location /longpolling {
    proxy_pass http://odoochat;
  }

  # Redirect requests to odoo backend server
  location / {
    proxy_redirect off;
    proxy_pass http://odoo;
  }
  
  #status page*******************************************+
  location /nginx_status {
    stub_status on;
    access_log off;
    allow 127.0.0.1;  # Only allow requests from localhost
    deny all;  # Deny all other requests
  }

  # common gzip
  gzip_types text/css text/scss text/plain text/xml application/xml application/json application/javascript;
  gzip on;
 }
 
#https
server {   
    listen 8443 ssl;   
    server_name odoo.example.com;   
    ssl_certificate /home/ximo/MyCerts/2024/webserver.crt
    ssl_certificate_key /home/ximo/MyCerts/2024/webserver.key;   
    
    ssl_client_certificate /home/ximo/MyCerts/2024/myCA.pem;
    #ssl_verify_client optional_no_ca; #NO VA
    ssl_verify_client on; #VA si no afafem certificat
    
    #ssl_verify_depth 3;
    
    proxy_set_header X-SSL-CERT $ssl_client_escaped_cert;
    
    access_log /var/log/nginx/odoo.example.access.log;   
    error_log /var/log/nginx/odoo.example.error.log;   
    
    
    
    #status page*******************************************+
    location /nginx_status {
      stub_status on;
      access_log off;
      allow 127.0.0.1;  # Only allow requests from localhost
      deny all;  # Deny all other requests
    }
    
    
    location / {   
        proxy_pass http://127.0.0.1:8069;   
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;  
    } 
} 

 

C. Segun chatgpt crear claves en odoo.conf de ODOO

10. Fichero odoo.conf

[options]
...
proxy_mode = True
ssl_certificate = /home/ximo/MyCerts/2024/webserver.crt
ssl_private_key = /home/ximo/MyCerts/2024/webserver.key

D. Si tenemos queremos que acepte certificados de varias CA.

En ese caso tenemos que empaquetar todos los certificados raiz en uno solo. Para ello se deben convertir a formato PEM

openssl x509 -in certca1.crt -out certca1.pem -outform PEM

cat certca1.pern certCA2.pem ... certCAn.pen >all_certs.pem

Y en la configuración de nginx cambiar esta línea

ssl_client_certificate /home/ximo/MyCerts/2024/all_certs.pem;