Getting Common Name from Distinguished Name of client certificate in NGINX

Question

I need to get the CN of a client certificate in NGINX to append it to the proxy headers.

I already found the following map code for this.

map $ssl_client_s_dn $ssl_client_s_dn_cn {
    default "";
    ~/CN=(?<CN>[^/]+) $CN;
}

But sadly it only returns an empty string for the following $ssl_client_s_dn: CN=testcn,O=Test Organization

I tested it with other DNs, too. But the problem is always the same.

Answer 1

The pattern you use requires the legacy DN, since it assumes the / to separate the RDNs. So (since nginx v1.11.6) the following works:

map  $ssl_client_s_dn_legacy  $ssl_client_s_dn_cn {
  default "";
  ~/CN=(?<CN>[^/]+) $CN;
}

With $ssl_client_s_dn_legacy: /O=Test Organization/CN=testcn