nginx 15 lines · 1 tab

Mutual TLS between internal services with Nginx

Kai Nakamura Apr 2026

1 tab

server {
  listen 443 ssl;
  server_name internal-api.example.com;

  ssl_certificate /etc/nginx/tls/server.crt;
  ssl_certificate_key /etc/nginx/tls/server.key;
  ssl_client_certificate /etc/nginx/tls/ca.crt;
  ssl_verify_client on;

  location / {
    proxy_set_header X-Client-Verify $ssl_client_verify;
    proxy_set_header X-Client-DN $ssl_client_s_dn;
    proxy_pass http://api_upstream;
  }
}

1 file · nginx Explain with highlit

mTLS is one of the cleanest ways to tighten internal service trust when you control both sides of the connection. I use it for sensitive east-west traffic where bearer credentials alone are too weak. Certificate lifecycle and revocation planning matter just as much as the TLS flags themselves.

Related snips

json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyInsecureTransport",
      "Effect": "Deny",

S3 bucket policy that enforces TLS and blocks public reads

s3 aws tls

by Kai Nakamura 1 tab

package deps

import (
  "crypto/tls"
  "crypto/x509"
  "net/http"

mTLS client configuration with custom root CA pool

go security tls

by Leah Thompson 1 tab

yaml

# Install cert-manager (Helm)
# helm install cert-manager jetstack/cert-manager #   --namespace cert-manager #   --create-namespace #   --set installCRDs=true

---
# ClusterIssuer for Let's Encrypt (staging)
apiVersion: cert-manager.io/v1

SSL/TLS certificates with Lets Encrypt and cert-manager

ssl tls certificates

by Ryan Nakamura 2 tabs

python

import requests

response = requests.get('https://crt.sh/', params={'q': '%.example.com', 'output': 'json'}, timeout=15)
response.raise_for_status()
certs = response.json()
print(certs[:5])

Certificate transparency checks for unexpected certificate issuance

certificate-transparency tls monitoring

by Kai Nakamura 1 tab

nginx

# Main nginx.conf

worker_processes auto;
worker_rlimit_nofile 65535;

events {

Nginx reverse proxy and load balancing

nginx reverse-proxy load-balancing

by Ryan Nakamura 1 tab

bash

#!/usr/bin/env bash
set -euo pipefail

certbot renew --quiet --deploy-hook "systemctl reload nginx"
openssl x509 -enddate -noout -in /etc/letsencrypt/live/example.com/fullchain.pem

TLS certificate automation with certbot and strict renewal checks

tls certificates certbot

by Kai Nakamura 1 tab

Share this code

Here's the card — post it anywhere.

Mutual TLS between internal services with Nginx — share card

Link copied