From Root CA to User Authorization in nginx and Apache: Client Certificate Login Explained
This is part three of a practical series on building a complete Root CA to user authorization system using nginx and Apache. The first two parts covered deployment of a two-level PKI with a Root CA and three intermediate CAs (Person, Server, Code), certificate revocation via CRL, and an OCSP responder.
The current part focuses on server-side configuration for client certificate authentication. It explains how to force nginx and Apache to request, validate, and forward X.509 client certificates to applications, and what changes when the application terminates TLS directly without a proxy.
Key differences between password and certificate login are highlighted: with certificates the private key never leaves the client, while the server verifies the signature and builds the chain to a trusted root. The tutorial stresses that the list of accepted CAs must contain only the Person intermediate CA to avoid offering unrelated certificates to users.
Practical steps include issuing a client certificate with extendedKeyUsage = clientAuth and keyUsage containing digitalSignature, packaging it as PKCS#12 for browser import, and enabling mTLS with full directive references. All nine reference tables covering 331 parameters from nginx ngx_http_ssl_module, Apache mod_ssl, and OpenSSL are included.
Special attention is given to secure header passing, login CSRF protection using separate hosts and one-time tokens, and revocation checking on the server side using both CRL and OCSP. The material was verified on nginx 1.29.8, Apache httpd 2.4, OpenSSL 3.3.7, and Go 1.24.
Related articles
Enthusiasts Bring Xbox Cloud Gaming and Native Windows Titles to PlayStation 5 via Homebrew
Homebrew developers have created two separate projects that expand the capabilities of modified PlayStation 5 consoles. The first project, PSBox Cloud Gaming by RafaelNGP, turns the console into a client for Microsoft’s Xbox Cloud Gaming service, streaming games at 1080p and 60 frames per second while supporting full DualSense features. The second project, prospero-win, uses Wine and compatibility layers to run Windows games locally on the PS5 hardware. Reported performance includes Half-Life 2 at high settings and 60 FPS, GTA IV at approximately 55 FPS in open-world areas at 1080p, and older titles such as Counter-Strike 1.6 and Warcraft III exceeding 60 FPS. Both projects require a console capable of running unofficial software and, for cloud gaming, a Game Pass Ultimate subscription for most of the library. The work remains experimental and depends on individual game compatibility.
Yandex Data Center Attacks Trigger Outages, Cloud Disruptions and Stock Decline
A series of physical attacks has disabled or partially damaged multiple Yandex data centers in Russia, leading to prolonged service outages across cloud and consumer platforms. Fires and power failures struck facilities in Sasovo, Kaluga and Vladimir between 8 and 11 October, forcing the company to shift workloads to the remaining Mytishchi site. Analysts from Finam, Rikom-Trust and Freedom Global note that recovery timelines now stretch from several months to two years for specialized hardware such as supercomputers. The incidents have already erased nearly 9 percent of Yandex share value and raised concerns over future capital expenditure, client retention in Yandex Cloud and potential sanctions complications for overseas expansion. Experts emphasize that the attacks have moved from isolated technical failures to a systemic business-continuity and investment-risk issue.
Cyber Attack on Danfoss Systems Forces Defrost in 250 French Supermarkets, Spoiling Stock
Hackers compromised refrigeration control systems supplied by Danfoss in French supermarket chains Intermarché and Coopérative U, activating continuous defrost cycles that raised temperatures to 50 °C. The sabotage affected between 150 and 200 Intermarché stores and nearly 100 Coopérative U locations, forcing retailers to discard large quantities of fresh and frozen goods. French authorities confirmed the incidents, with the Paris prosecutor’s office opening an investigation after reports of associated fires. The attackers exploited the normal maintenance function of the Danfoss equipment, turning brief defrost cycles into prolonged warming that broke the cold chain. Coopérative U chairman Dominique Schelcher described the event as unprecedented and stated that technical teams are working with refrigeration specialists to restore operations. No group has claimed responsibility, and investigators continue to examine the initial access vector. The incident illustrates how manipulation of industrial control systems can produce immediate physical and financial damage without traditional data theft or encryption.
Yandex Cloud Cascade Failure October 2026 Exposes Multi-AZ Limits and Capacity Exhaustion Risks
In October 2026, Yandex Cloud suffered a prolonged cascade outage across multiple data centers in Sасово, Калуга, and Владимир, triggered by power failures and a drone-related fire that fully disabled the ru-central1-b zone. The incident revealed that standard Multi-AZ designs reach physical capacity exhaustion when multiple zones fail simultaneously, leaving insufficient resources in remaining zones for automatic failover. Businesses relying on managed Kubernetes, databases, and SaaS platforms such as Salebot and CIAN experienced extended recovery times, with backups becoming inaccessible and RTO stretching beyond 24 hours due to index rebuilds and manual quota allocation. Yandex Cloud responded by manually distributing quotas, partnering with Selectel, K2Cloud, and VK Cloud for emergency capacity, and advising clients to activate external disaster recovery plans. The outage also highlighted single points of failure in DDoS protection configurations and Control Plane dependencies that prevented timely migration of master nodes. Architectural recommendations include deploying independent edge webhook buffers using FastAPI on separate VDS instances to preserve incoming events during primary backend failures. Overall, the events underscore the necessity of true multi-cloud strategies that avoid reliance on any single provider's IAM, billing, and physical infrastructure.