Undo #11062 since it breaks the nginx config (#11082)

* [mTLS] Fix acme verfication when mTLS and Client CN verification is enabled * revert mTLS location excluding acme-challenge since each location will match ultimately resulting in 404 for all request paths
kubernetes · Mar 9, 2024 · 9c384c7 · 9c384c7
1 parent 157e53b
commit 9c384c7
Showing 1 changed file with 2 additions and 4 deletions.
diff --git a/rootfs/etc/nginx/template/nginx.tmpl b/rootfs/etc/nginx/template/nginx.tmpl
@@ -985,10 +985,8 @@ stream {
 
         {{ if not ( empty $server.CertificateAuth.MatchCN ) }}
         {{ if gt (len $server.CertificateAuth.MatchCN) 0 }}
-        location ~ ^/(?!(\.well-known/acme-challenge)) {
-            if ( $ssl_client_s_dn !~ {{ $server.CertificateAuth.MatchCN }} ) {
-                return 403 "client certificate unauthorized";
-            }
+        if ( $ssl_client_s_dn !~ {{ $server.CertificateAuth.MatchCN }} ) {
+            return 403 "client certificate unauthorized";
         }
         {{ end }}
         {{ end }}