From Root CA to User Authorization in nginx and Apache: Client Certificate Login Explained
This is part three of a practical series on building a complete Root CA to user authorization system using nginx and Apache. The first two parts covered deployment of a two-level PKI with a Root CA and three intermediate CAs (Person, Server, Code), certificate revocation via CRL, and an OCSP responder.
The current part focuses on server-side configuration for client certificate authentication. It explains how to force nginx and Apache to request, validate, and forward X.509 client certificates to applications, and what changes when the application terminates TLS directly without a proxy.
Key differences between password and certificate login are highlighted: with certificates the private key never leaves the client, while the server verifies the signature and builds the chain to a trusted root. The tutorial stresses that the list of accepted CAs must contain only the Person intermediate CA to avoid offering unrelated certificates to users.
Practical steps include issuing a client certificate with extendedKeyUsage = clientAuth and keyUsage containing digitalSignature, packaging it as PKCS#12 for browser import, and enabling mTLS with full directive references. All nine reference tables covering 331 parameters from nginx ngx_http_ssl_module, Apache mod_ssl, and OpenSSL are included.
Special attention is given to secure header passing, login CSRF protection using separate hosts and one-time tokens, and revocation checking on the server side using both CRL and OCSP. The material was verified on nginx 1.29.8, Apache httpd 2.4, OpenSSL 3.3.7, and Go 1.24.
Related articles
Developer Builds Custom Bouncer Tool to Automatically Block .env and SSH Probing on VPS
A system administrator running a small VPS with Caddy and static sites grew tired of constant password guessing attempts against SSH and repeated probes for files like .env, wp-admin, and config.php.bak. Instead of relying on Fail2ban, which required complex jail and filter configuration, the admin created a lightweight Rust-based tool named Bouncer. The program first crawls the site to build a list of legitimate paths, then monitors access logs and systemd journal entries for SSH invalid user attempts. IPs that generate multiple 404 responses for unknown paths or trigger SSH invalid user messages are added to an nftables set for automatic blocking. Special immediate bans are applied for direct hits on sensitive files such as /.env. The tool avoids double-counting SSH log lines, skips historical log replay on startup, and integrates directly with existing nftables rules without requiring additional runtime dependencies.
Russia Plans to Expand MAX Messenger with Unified Ticket Purchases Across All Transport Types
The Russian Ministry of Transport is developing new features for the MAX messenger to allow users to plan routes and purchase tickets for urban transport, trains, airplanes, and sea or river vessels within a single application. First Deputy Minister Konstantin Pashkov stated that the platform already supports verification of eligibility for discounted travel and handling of travel documents. Future plans include greater reliance on biometric identification, enabling passengers to complete bookings digitally and board using camera recognition without showing QR codes or physical documents. The initiative forms part of a gradual transition, with no immediate plans to phase out existing payment methods. New regulations effective from September 1 permit confirmation of social benefits through MAX and the use of biometric services where carriers have the required equipment. No specific timeline for full implementation of integrated ticketing has been provided.
5G Icon Appears on Select iPhones for Russian Users as Operators Expand Coverage
Some iPhone owners in Russia have observed the 5G indicator replacing LTE in the status bar, marking the first signs of fifth-generation network access on Apple devices. The change has been confirmed by a RIA Novosti correspondent but remains limited to a portion of users, with no official details released on supported models, carriers, or regions. Russian operators from the Big Four launched 5G services in 16 cities one week earlier, granting potential access to roughly 10 million subscribers. The initial rollout operates primarily on previously allocated LTE spectrum bands, delivering an estimated 20-25% increase in network throughput. Unlike Android devices, where the Ministry of Digital Development planned to enable compatible hardware directly, iPhone activation requires Apple to authorize specific operator frequencies and network configurations. Observers note that the presence of the 5G icon does not yet guarantee widespread deployment or significant speed gains, as performance depends on coverage, spectrum, device model, and network load.
Former Google DeepMind Engineer Bilal Chughtai Warns AI Could Cause Human Extinction Without Coordinated Safety Measures
Bilal Chughtai, who worked on advanced AI safety at Google DeepMind before leaving the company in July 2026, stated that artificial intelligence could lead to the extinction of humanity. He emphasized that while safe development remains possible, AI labs must coordinate efforts and stop the reckless race toward more powerful systems. Chughtai argued that development pace should match what society can safely handle, with threats assessed and mitigated before they cause extreme damage. Similar warnings have come from Anthropic researchers including Jacob Coxon, who suggested advanced models could cause human extinction by the end of the decade, and Evan Hubinger, who estimated over 10% probability within ten years. Anthropic CEO Dario Amodei called for slowing frontier model development when safety measures lag capabilities, a view supported by Elon Musk and OpenAI CEO Sam Altman. The discussion focuses on external audits, unified standards, and controlled progress rather than a complete halt. U.S. President Donald Trump dismissed AI regulation calls as a hoax, creating a divide between industry caution and policy resistance, as noted by Reuters.