Getting Common Name from Distinguished Name of client certificate in NGINX

问题

I need to get the CN of a client certificate in NGINX to append it to the proxy headers.

I already found the following map code for this.

map $ssl_client_s_dn $ssl_client_s_dn_cn {
    default "";
    ~/CN=(?<CN>[^/]+) $CN;
}

But sadly it only returns an empty string for the following $ssl_client_s_dn: CN=testcn,O=Test Organization

I tested it with other DNs, too. But the problem is always the same.

回答1:

The pattern you use requires the legacy DN, since it assumes the / to separate the RDNs. So (since nginx v1.11.6) the following works:

map  $ssl_client_s_dn_legacy  $ssl_client_s_dn_cn {
  default "";
  ~/CN=(?<CN>[^/]+) $CN;
}

With $ssl_client_s_dn_legacy: /O=Test Organization/CN=testcn

回答2:

As @christof-r mentioned, your regex matched with the legacy DN pattern. Please use this regex to match with the current ( > v1.11.6) pattern.

map $ssl_client_s_dn $ssl_client_s_dn_cn {
    default "";
    ~CN=(?<CN>[^,]+) $CN;
}

来源：https://stackoverflow.com/questions/55325548/getting-common-name-from-distinguished-name-of-client-certificate-in-nginx