From 1832b2bb3e9948f8bf6dfb3be50fd10363bc3a38 Mon Sep 17 00:00:00 2001 From: omnom62 Date: Wed, 12 Aug 2026 15:22:05 +1000 Subject: http-api: T8989: address further review comments - Scope mTLS CA chain to selected CA only (not all configured CAs) - Pass verify-client value to nginx template instead of hardcoding optional - Allow mTLS-only REST configuration without API keys - Add mTLS warning when no API keys are configured --- data/templates/https/nginx.default.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'data/templates/https/nginx.default.j2') diff --git a/data/templates/https/nginx.default.j2 b/data/templates/https/nginx.default.j2 index e655bd8ca..8b9bb4e23 100644 --- a/data/templates/https/nginx.default.j2 +++ b/data/templates/https/nginx.default.j2 @@ -51,7 +51,7 @@ server { {% if certificates.mtls_ca_path is vyos_defined %} # mTLS - client certificate verification ssl_client_certificate {{ certificates.mtls_ca_path }}; - ssl_verify_client optional; + ssl_verify_client {{ certificates.verify_client }}; ssl_verify_depth 2; {% endif %} # proxy settings for HTTP API, if enabled; 503, if not -- cgit v1.2.3