How to make authorization by client certificates in nginx?

Question

Nginx

Hello everyone,
it became necessary to determine from which place the client comes from when authorizing on the site.
To do this, I decided to use certificates - create them for different places, and use php to check which one came to the server.
It is necessary that those who do not have a certificate would simply go further, but if it is, then it must be passed on to php for processing.
I did it according to this article - https://habrahabr.ru/post/213741/
and as a result I got the following config for nginx:

server {
  server_name domain.ru
  ssl on;
  ssl_certificate "/var/www/httpd-cert/user/domain.ru_le1.crtca";
  ssl_certificate_key "/var/www/httpd-cert/user/domain.ru_le1.key";
  ssl_client_certificate "/var/www/user/data/certs/ca.crt";
  ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:DHE-DSS-CAMELLIA256-SHA:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-RSA-AES256-SHA384:ECDH-ECDSA-AES256-SHA384:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:CAMELLIA256-SHA:PSK-AES256-CBC-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:DHE-RSA-SEED-SHA:DHE-DSS-SEED-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-DSS-CAMELLIA128-SHA:ECDH-RSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-RSA-AES128-SHA256:ECDH-ECDSA-AES128-SHA256:ECDH-RSA-AES128-SHA:ECDH-ECDSA-AES128-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:SEED-SHA:CAMELLIA128-SHA:PSK-AES128-CBC-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:ECDH-RSA-DES-CBC3-SHA:ECDH-ECDSA-DES-CBC3-SHA:DES-CBC3-SHA:IDEA-CBC-SHA:PSK-3DES-EDE-CBC-SHA:KRB5-IDEA-CBC-SHA:KRB5-DES-CBC3-SHA:KRB5-IDEA-CBC-MD5:KRB5-DES-CBC3-MD5:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:RC4-SHA:RC4-MD5:PSK-RC4-SHA:KRB5-RC4-SHA:KRB5-RC4-MD5;
  ssl_prefer_server_ciphers on;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_verify_client optional;
  add_header Strict-Transport-Security "max-age=31536000;";
  charset off;
  index index.html index.php;
  disable_symlinks if_not_owner from=$root_path;
  include /etc/nginx/vhosts-includes/*.conf;
  include /etc/nginx/vhosts-resources/domain.ru/*.conf;
  error_log /var/www/httpd-logs/domain.ru.error.log notice;
  ssi on;
  set $root_path /var/www/data/www/domain.ru;
  root $root_path;
  listen 127.0.0.1:443;
  location / {
    location ~ [^/]\.ph(p\d*|tml)$ {
      try_files /does_not_exists @fallback;
    }
    location ~* ^.+\.(jpg|jpeg|gif|png|svg|js|css|mp3|ogg|mpe?g|avi|zip|gz|bz2?|rar|swf)$ {
      try_files $uri $uri/ @fallback;
    }
    location / {
      try_files /does_not_exists @fallback;
    }
  }
  location @fallback {
    proxy_pass http://127.0.0.1:8080;
    proxy_redirect http://127.0.0.1:8080 /;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Port $server_port;
    #proxy_set_header X-Custom-Cert $scheme;
    access_log off;
  }
  access_log off;
}

If I install a client certificate into the system, I get the error "400 Bad Request The SSL certificate error"
In the logs, this is what happens:

2017/04/28 11:12:59 [alert] 1715#1715: *13035022 ignoring stale global SSL error (SSL: error:0D0C50A1:asn1 encoding routines:ASN1_item_verify:unknown message digest algorithm) while waiting for request, client: 127.0.01, server: 127.0.01:443

If the browser does not send the certificate, then everything is OK.
Tell me what could be the problem?
Thank you!

Answer 1

// Сертификат самого сервера с цепочкой к корневому
        ssl_certificate         /etc/ssl/virtex/certs/any.domain.kz.crt;
        // Приватный ключ rsa
        ssl_certificate_key     /etc/ssl/virtex/private/any.domain.kz.nopass.key;

        // Корневой сертификат
        ssl_client_certificate  /etc/ssl/virtex/ca.cert.crt;
        ssl_verify_client       on;

and nothing else is needed