title: Nginx Proxy pass certificate autentificate to MS IIS
body: <p>Nginx 1.9.5 (linux Centos7)--> MS IIS 8.5
  So i try to use nginx as client revers proxy for IIS where need client certificate authentication at IIS level.
  nginx:443->>IIS:443+client certificate authentications.</p>
  
  <p>example location proxy pass
  also here are commented commands which i try.</p>
  
  <pre><code>location ^~ /test/ {
  #proxy_buffering off;
  #proxy_http_version 1.0;
  #proxy_request_buffering off;
  #proxy_set_header Connection "Keep-Alive";
  #proxy_set_header X-SSL-CERT $ssl_client_cert;
  # proxy_ssl_name domain.lv;
  #proxy_ssl_trusted_certificate /etc/nginx/ssl/root/CA.pem;
  #proxy_ssl_verify_depth 2;
  
  proxy_set_header HOST domain.com;
  proxy_ssl_certificate /etc/nginx/ssl/test.pem;
  proxy_ssl_certificate_key /etc/nginx/ssl/test_key.pem;
  proxy_ssl_verify off;
  proxy_pass https://10.2.4.101/;
  
   }
  </code></pre>
  
  <p>At IIS simple.</p>
  
  <ol>
  <li>create new website.</li>
  <li>import CA cert in trusted root.</li>
  <li>set ssl cert required.</li>
  </ol>
  
  <p>Test what i get :</p>
  
  <ol>
  <li>Directly browser to IIS client cert required--worked.</li>
  <li>Nginx to other nginx client cert required--worked.</li>
  <li>Nginx to IIS client cert ignore--worked</li>
  <li>Nginx to IIS client cert required or accept - NOT work</li>
  </ol>
  
  <p>ERROR:
  Nginx side:
  *4622 upstream timed out (110: Connection timed out) while reading response header from upstream
  IIS side:
  500 0 64 119971</p>
  
  <p>So i hope someone could know why?</p>
  
  <p>EDIT
  1. also try from different server with nginx 1.8 nothing helped..</p>
  
  <pre><code>proxy_ssl_verify off;
  proxy_ssl_certificate /etc/nginx/ssl/test/test.pem;
  proxy_ssl_certificate_key /etc/nginx/ssl/test/test_key.pem;
  proxy_pass https://domain.com;
  </code></pre>
  
  <p>2.Try same with apache 2.4 all worked with</p>
  
  <pre><code>SSLProxyEngine On
  SSLProxyVerify none
  SSLProxyCheckPeerCN off
  SSLProxyCheckPeerName off
  SSLProxyCheckPeerExpire off
  SSLProxyMachineCertificateFile /etc/httpd/ssl/test.pem
  ProxyPass "/test" "https://domain.com"
  </code></pre>
  
  <p>Maybe something with ssl renegotiation in nginx???</p>