$ssl_client_fingerprint

Description

The $ssl_client_fingerprint variable is used in NGINX when SSL client authentication is enabled. It provides a unique fingerprint for the client's SSL certificate that is based on a cryptographic hash, usually generated using the SHA-1 or SHA-256 hashing algorithms. This fingerprint is derived from the certificate's data, specifically its `tbsCertificate` structure. The variable is set only when SSL client authentication is successfully performed, meaning that the server has been configured to require client certificates and the client has presented a valid certificate during the SSL handshake. Typical values of this variable will resemble a hex string format representing the hash of the client's certificate. This is useful for logging, access control, and applying additional custom logic based on client identity.

Config Example

server {
    listen 443 ssl;
    ssl_certificate /path/to/server.crt;
    ssl_certificate_key /path/to/server.key;
    ssl_client_certificate /path/to/ca.crt;
    ssl_verify_client on;

    location / {
        # Use the fingerprint in access logs
        access_log /var/log/nginx/access.log combined; # Redis or any other designated log format
        set $client_fp $ssl_client_fingerprint;
        if ($client_fp) {
            # More logic can be applied here based on the fingerprint
        }
    }
}