Lion Cipher Lab
Authenticate clients with mutual TLS (mTLS) using nginx and your own CA
- Identity & Access Management
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Passwords and API keys are secrets that can be stolen, phished, or leaked in a log. A client certificate is different: the private half never leaves the machine that owns it, so presenting a valid one proves 'I am the service I claim to be' in a way a copied string can't. This is how zero-trust internal networks, service-to-service APIs, and many VPNs decide who is allowed to even open a connection. Building the whole thing by hand once — your own CA, a server cert, a client cert, and a server that demands one — turns mTLS from an intimidating buzzword into something you can set up, break,…
What you'll learn
- Mutual TLS (mTLS) client authentication
- building a private Certificate Authority (CA) with OpenSSL
- issuing and signing X.509 server and client certificates
- configuring nginx client-certificate verification (ssl_verify_client / ssl_client_certificate)
- proving an mTLS policy works by watching a request get rejected, then accepted
- reasoning about certificate rotation, revocation, and when mTLS is the wrong tool
Steps in this lab
- TLS in one breath — and what makes it *mutual*
- When you'd reach for mTLS — and when you absolutely wouldn't
- Make a working folder and a private network for the lab
- Build your private Certificate Authority (the trust anchor)
- Issue the server's certificate, signed by your CA
- Issue a client certificate — the ID card the caller will present
- Write the nginx config that DEMANDS a client certificate
- Run nginx in Docker with your certs and config
- Prove the policy works: a request with NO certificate is rejected
- Prove it again: the client certificate gets you in
- The reality: rotation, revocation, and why pros don't do this by hand
- Clean up