How to organize access by certificate to the server?

Question

linux

The essence of the question is as follows:
There is a site www.site.com
It works on HTTPS - a certificate from Let's Encrypt
It is necessary to add user authorization to this by the issued certificate.
Those. certificates for users are generated on the server and they can use them to enter the site.

UPD! The Let's Encrypt certificate should still work!
All the examples that were written are designed for simple authorization by certificate!
And you need to have a Let's Encrypt connection and authorization using a self-signed certificate...

Answer 1

Authorization of clients in nginx using an SSL certificate

Answer 2

So what prevents
a) to make certificates for users on the server in OpenSSL and distribute them so that they add them to their storage?.
b) to fasten authorization by certificate to the server? https://stuff-things.net/2015/09/28/configuring-ap...
UPD

UPD! The Let's Encrypt certificate should still work!
All the examples that were written are designed for simple authorization by certificate!
And you need to have a Let's Encrypt connection and authorization using a self-signed certificate...

Did you check? I have everything working as it should. Here is a detailed Russian instruction for you: https://www.opennet.ru/base/sec/ssl_cert.txt.html
I personally checked it, it works as it should, i.e. authorization by a self-signed certificate, but at the same time Let'sencrypt confirms the domain.

Answer 3

- Create a CA
- Issue certificates for users in it
- Configure the server to require a certificate from a specific CA (your)
- Distribute certificates to users
- Warn about responsibility for impersonation (when someone who knows the password from a user login gains access to the profile in which the certificate and enters the site as if he were the right user, that is, no one canceled the requirement of a strong password)