cis-nginx-v300-4-1-9

name	cis-nginx-v300-4-1-9
description	Ensure upstream server traffic is authenticated with a client certificate (Manual)
category	cis-nginx
version	3.0
author	cyberstrike-official
tags	["cis","nginx","web-server","reverse-proxy","tls-ssl","encryption"]
cis_id	4.1.9
cis_benchmark	CIS NGINX Benchmark v3.0.0
tech_stack	["nginx","linux","web-server"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS 4.1.9 — Ensure upstream server traffic is authenticated with a client certificate

Profile Applicability

• Level 1 - Proxy
• Level 1 - Loadbalancer

Description

In a reverse proxy configuration, NGINX acts as a client when communicating with an upstream server. To secure this server-to-server connection based on a Zero Trust principle, mutual TLS (mTLS) must be used. This is achieved by configuring NGINX to present its own client certificate to the upstream server. The upstream server then authenticates NGINX based on this certificate, ensuring that only trusted proxies can access backend services.

Rationale

Authenticating the proxy's connection to the upstream server via a client certificate provides strong, cryptographic proof of identity. This is vastly superior to weaker authentication methods like IP whitelisting, which can be spoofed. In a modern microservices or cloud environment, mTLS is a cornerstone of network security, as it prevents unauthorized services from making requests to sensitive backends, thereby mitigating lateral movement attacks.

Impact

Implementing mTLS introduces operational overhead for certificate management. You must have a process (often an internal Public Key Infrastructure, or PKI) for issuing, renewing, and revoking these client certificates. If the client certificate used by NGINX expires, or if the CA certificate on the upstream server expires, the connection between NGINX and the upstream will fail, leading to a service outage.

Audit Procedure

Run the following command to inspect the fully loaded NGINX configuration for the required directives:

nginx -T 2>/dev/null | grep -E \
'^\s*(proxy_ssl_certificate|proxy_ssl_certificate_key)'

Verify that the output includes both proxy_ssl_certificate and proxy_ssl_certificate_key directives with the correct paths within the relevant location block.

Note: A complete audit is two-sided. You must also verify that the upstream server is configured to require and validate client certificates against a trusted CA. This part of the audit is outside the scope of the NGINX configuration itself.

Remediation

Implementing mTLS requires configuration on both the NGINX proxy (the client) and the upstream server (the server). This example assumes you have a simple internal CA.

Prerequisite: Create a CA

# Create CA Key
openssl genrsa -out my-ca.key 4096
# Create CA Certificate
openssl req -x509 -new -nodes -key my-ca.key -sha256 -days 3650 -out my-ca.crt