https://blog.imcaoxuan.cn/en/tags/nginx/Recent content in Nginx on CX's BlogHugoen-USimcaoxuan.cnMon, 26 Oct 2026 00:00:00 +0000https://blog.imcaoxuan.cn/en/posts/2026-10-26-mtls-client-cert-macos-ios/Mon, 26 Oct 2026 00:00:00 +0000https://blog.imcaoxuan.cn/en/posts/2026-10-26-mtls-client-cert-macos-ios/<h1 id="accessing-mtls-websites-with-client-certificates-on-macos-and-ios">Accessing mTLS Websites with Client Certificates on macOS and iOS</h1> <p>This article explains how to configure client certificates on macOS and iOS devices to access HTTPS websites that enable mutual TLS (mTLS). The examples use a private CA, <code>step-ca</code>, Nginx, PKCS#12, and a PIV smart card. All domain names, certificate names, filenames, and IP addresses in this article are examples; replace them with your actual values.</p> <h2 id="1-mtls-authentication-process">1. mTLS Authentication Process</h2> <p>With ordinary HTTPS, the client primarily validates the server certificate; mTLS additionally requires the server to validate the client certificate.</p>https://blog.imcaoxuan.cn/en/posts/2026-10-26-mtls-practice/Mon, 26 Oct 2026 00:00:00 +0000https://blog.imcaoxuan.cn/en/posts/2026-10-26-mtls-practice/<h1 id="accessing-mtls-websites-with-client-certificates-on-mac-and-iphone">Accessing mTLS Websites with Client Certificates on Mac and iPhone</h1> <p>This article documents how to use client certificates to access an internal mTLS website on macOS and iPhone. It covers CanoKey PIV, <code>step-ca</code>, Nginx, and installing system certificates on iOS.</p> <h2 id="1-environment-and-authentication-flow">1. Environment and Authentication Flow</h2> <p>The current environment is as follows:</p> <ul> <li>CA: The existing <code>CX-Homelab-CA Root CA</code> and <code>CX-Homelab-CA Intermediate CA</code>.</li> <li>Certificate issuance: <code>step-ca</code>.</li> <li>Web server: Nginx 1.25.0.</li> <li>Test site: <code>https://www.home.arpa</code>.</li> <li>Mac client: CanoKey PIV 9A.</li> <li>iPhone client: A client certificate and private key imported through a PKCS#12 file.</li> </ul> <p>The difference between mTLS and ordinary HTTPS is that the server validates the client certificate, while the client must also validate the server certificate. The client certificate must contain the corresponding private key; installing a <code>.crt</code> file alone is generally insufficient to complete client authentication.</p>