[mTLS] Fix acme verfication when mTLS and Client CN verification is e…

…nabled (#11062)
kubernetes · Mar 8, 2024 · 7d12628 · 7d12628
1 parent f3a4f07
commit 7d12628
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/rootfs/etc/nginx/template/nginx.tmpl b/rootfs/etc/nginx/template/nginx.tmpl
@@ -985,8 +985,10 @@ stream {
 
         {{ if not ( empty $server.CertificateAuth.MatchCN ) }}
         {{ if gt (len $server.CertificateAuth.MatchCN) 0 }}
-        if ( $ssl_client_s_dn !~ {{ $server.CertificateAuth.MatchCN }} ) {
-            return 403 "client certificate unauthorized";
+        location ~ ^/(?!(\.well-known/acme-challenge)) {
+            if ( $ssl_client_s_dn !~ {{ $server.CertificateAuth.MatchCN }} ) {
+                return 403 "client certificate unauthorized";
+            }
         }
         {{ end }}
         {{ end }}