SSLクライアント認証に関係する中間証明局とnginxの設定

openssl genrsa -out ca.key 4096

openssl req -new -x509 -days 365 -key ca.key -out ca.crt

Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:XXX
Locality Name (eg, city) []:XXX
Organization Name (eg, company) [Internet Widgits Pty Ltd]:XXX
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:xxx.xxx.xxx
Email Address []:xxx@xxx.xxx

openssl genrsa -out client.key 4096

openssl req -new -key client.key -out client.csr

Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:Tokyo
Locality Name (eg, city) []:Shibuya
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Example, Inc.
Organizational Unit Name (eg, section) []:Customer Support
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

openssl x509 -req -days 365 -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt

openssl pkcs12 -export -out client.p12 -inkey client.key -in client.crt -certfile ca.crt

server {
    listen       80;
    server_name  xxx.xxx.xxx;
    return 301 https://$host$request_uri;
}
server {
       listen       443 ssl http2;
       ssl_protocols TLSv1.2 TLSv1.3;
       ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;

       server_name  xxx.xxx.xxx;
       root         /var/www/web;
       index        index.html index.htm;

       ssl_certificate "/etc/letsencrypt/live/xxx.xxx.xxx/fullchain.pem";
       ssl_certificate_key "/etc/letsencrypt/live/xxx.xxx.xxx/privkey.pem";
       ssl_session_cache shared:SSL:1m;
       ssl_session_timeout  10m;

       ssl_client_certificate "/etc/nginx/client_certificates/ca.crt";
       ssl_verify_client on;
       ssl_verify_depth 2;

       location / {
              try_files $uri $uri/ =404;
       }
}