nginx.conf

server {
	# null-cipher HTTPS configuration
	listen 442 ssl default_server;
	listen [::]:442 ssl default_server;

	# replace with the path for the server's certificates
	include snippets/snakeoil.conf;

	# disable encryption
	ssl_protocols TLSv1.2;
	ssl_ciphers  NULL-SHA256:@SECLEVEL=0;
	# enable client authentication
	ssl_client_certificate /home/qsantos/src/hamttpd/ca.pem;  # replace with proper path
	ssl_verify_client optional;

	location / {
		set_escape_uri $ssl_client_s_dn_legacy;
		proxy_pass "http://127.0.0.1:8000$uri?dn=$ssl_client_s_dn_legacy&$args";
	}
}

# non-Ham server
server {
	listen 80 default_server;
	listen [::]:80 default_server;

	# traditional HTTPS configuration
	listen 443 ssl default_server;
	listen [::]:443 ssl default_server;
	# enable client authentication
	ssl_client_certificate /home/qsantos/src/hamttpd/ca.pem;  # replace with proper path
	ssl_verify_client optional;

	# replace with the path for the server's certificates
	include snippets/snakeoil.conf;

	location / {
		proxy_pass "http://127.0.0.1:8000$uri?dn=$ssl_client_s_dn_legacy&$args";
	}
}