title: uwsgi/nginx/django client certificate authentication elevation at runtime
body: <h1>Preamble</h1>
  <p>I have a django application set up to run under uwsgi proxy passed by nginx. In Iceland we have a smart card client certificate system in place, embedded in debet cards, distributed free by the debet card issuers, i.e. banks. I am attempting to support this environment for authentication, while retaining the ability to issue logic when authenticating, making the process interactive for the user. Currently we use Apache/mod_wsgi to host the application and use a location directive /auth/smartcard where we require client certificate handshakes. The root of the site is just plain https. This relegates the process to the server only, denying us the ability to interact with the user in a constructive manner.</p>
  <h2>The configuration so far</h2>
  <p><strong>uWSGI ini:</strong></p>
  <pre><code>[uwsgi]
  chdir=/home/vagrant/gimli/src
  socket=localhost:5000
  processes=1
  module=application_name.wsgi:application
  env DJANGO_SETTINGS_MODULE=application_name.settings
  max-requests=5000
  home=/home/vagrant/virtualenvs/gimli
  py-autoreload=True
  </code></pre>
  <p><strong>nginx settings</strong></p>
  <pre><code>server {
  &lt;snip&gt;
  ssl on;
  ssl_protocols SSLv3 TLSv1;
  ssl_certificate ssl/host.domain.is.crt;
  ssl_certificate_key ssl/host.domain.is.key;
  ssl_client_certificate ssl/ca_chain.crt;
  ssl_verify_client optional;
  ssl_verify_depth 2;
  
  error_log /var/log/nginx/host.domain.error.log debug; # debug for debugging ssl
  access_log /var/log/nginx/host.domain.is.access.log;
  
  location / {
  include uwsgi_params;
  
  # Client cert support
  uwsgi_param SSL_CLIENT_ID $ssl_client_s_dn;
  
  # Bind parameters
  uwsgi_pass localhost:5000;
  }
  &lt;/snip&gt;
  } # /server
  </code></pre>
  <p>These configurations enable SSL and optional client certificates if supplied to the browser by the smartcard reader (usb dongle). Therefore the ssl_verify_client optional directive. We are not married to Nginx, though we would prefer not to run uwsgi naked.</p>
  <h2>The question</h2>
  <p>Is it possible - at runtime - to issue a directive back from the application to the server to elevate the ssl connection to require a client certificate, using either uwsgi or nginx? Is it possible, essentially, to alter the state of the ssl_verify_client setting, renegotiating the ssl handshake?</p>