diff options
| author | omnom62 <omnom62@outlook.com> | 2026-08-12 15:22:05 +1000 |
|---|---|---|
| committer | John Estabrook <jestabro@vyos.io> | 2026-08-26 13:33:34 -0500 |
| commit | 1832b2bb3e9948f8bf6dfb3be50fd10363bc3a38 (patch) | |
| tree | f7ffa4ae5bc477d81ab927bc17fc64377c67954f /data/templates/https/nginx.default.j2 | |
| parent | d62e57071f2afb83879f576f6a3af5ecaa21023b (diff) | |
| download | vyos-1x-1832b2bb3e9948f8bf6dfb3be50fd10363bc3a38.tar.gz vyos-1x-1832b2bb3e9948f8bf6dfb3be50fd10363bc3a38.zip | |
http-api: T8989: address further review comments
- Scope mTLS CA chain to selected CA only (not all configured CAs)
- Pass verify-client value to nginx template instead of hardcoding optional
- Allow mTLS-only REST configuration without API keys
- Add mTLS warning when no API keys are configured
Diffstat (limited to 'data/templates/https/nginx.default.j2')
| -rw-r--r-- | data/templates/https/nginx.default.j2 | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/data/templates/https/nginx.default.j2 b/data/templates/https/nginx.default.j2 index e655bd8ca..8b9bb4e23 100644 --- a/data/templates/https/nginx.default.j2 +++ b/data/templates/https/nginx.default.j2 @@ -51,7 +51,7 @@ server { {% if certificates.mtls_ca_path is vyos_defined %} # mTLS - client certificate verification ssl_client_certificate {{ certificates.mtls_ca_path }}; - ssl_verify_client optional; + ssl_verify_client {{ certificates.verify_client }}; ssl_verify_depth 2; {% endif %} # proxy settings for HTTP API, if enabled; 503, if not |