feat: mTLS with nginx and python

[HarryPaulo]

When we are going to integrate 2 systems where we need a high level of security between the two ends of the communication, we must use mTLS to verify and validate that the requests received from the client have the certificate...
Normally this type of integration does not work with HMAC, it must use mTLS.

So, I looked for the most efficient and flexible configuration to apply this, thinking that on a server with a "bench" we will have more than one site and each site can have more than one integration enabled with mTLS certificate configured and each integration can have your own certificate

The ngnix configuration was chosen:
ssl_verify_client optional_no_ca
optional_no_ca: requests the client certificate but does not require it to be signed by a trusted CA certificate. This is intended for the use in cases when a service that is external to nginx performs the actual certificate verification. The contents of the certificate is accessible through the $ssl_client_cert variable.

"proxy_set_header SSL_CLIENT_CERT $ssl_client_cert;": allows you to get the certificate from the header, using a relative variable.

So with this config, i can made a validade on Python loading the certificate configured on relative integration and confirming the identity:

ps: Maybe there are some more points to be implemented, I will be putting my application into production in a few days or weeks...

I am open to suggestions

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[HarryPaulo]

I'm working on it, and I think this first change wasn't a good one because it's in the base url location / {...}

I'm studying and exploring something that fits better.