nginx location match on ssl_client_verify <p>I'm trying to setup nginx in order to match certain URL on server where conditional access is granted (i.e. only those with valid client certificate are allowed to access this area).</p> <p>Right now, simple location block works fine preventing access to unauthorized users:</p> <pre><code>location ~ ^/protected/ticketing { if ($ssl_client_verify != SUCCESS) { return 401; } #need treatment of php files here after SUCCESS = $ssl_client_verify ?! } </code></pre> <p>So no one can access /protected/ticketing/anyThingHere</p> <p>BUT. When you actually present a valid certificate, and this return 401 does not trigger, /protected/ticketing/index.php is not parsed by an upstream FPM server but instead is presented for download (i.e. content disposition is set to default octet stream). </p> <p>Is there an elegant way of doing this?</p> <p>My upstream is defined as:</p> <pre><code>upstream backend { server unix:/var/run/php5-fpm.sock; } </code></pre> <p>PHP handler location block:</p> <pre><code>location ~ [^/]\.php(/|$) { fastcgi_split_path_info ^(.+?\.php)(/.*)$; if (!-f $document_root$fastcgi_script_name){return 404;} fastcgi_pass backend; #pass request to the upstream fastcgi_index index.php; include fastcgi_params; } </code></pre>