title: How to set up two-way SSL in Nginx for custom location?
body: <p>I have a rails 4 project with some API.</p>
  
  <p>This project runs with <code>nginx v.1.6.3</code> and <code>https</code> on production.</p>
  
  <p>Nginx configurations:</p>
  
  <pre><code>upstream app {
      # Path to Unicorn SOCK file, as defined previously
      server unix:/tmp/unicorn.my_domain.sock fail_timeout=0;
  }
  
  server {
         listen         80;
         server_name    my_domain.com;
         return         301 https://$server_name$request_uri;
  }
  
  server {
      listen 443 ssl;
  
      ssl_certificate /etc/nginx/ssl/public.crt;
      ssl_certificate_key /etc/nginx/ssl/private.rsa;    
  
      server_name my_domain.com;
  
      root /var/www/current;
  
      location /assets {
          root /var/www/current/public;
          gzip_static on;
          expires max;
          add_header Cache-Control public;
      }
  
      try_files $uri/index.html $uri @app;
  
      location @app {
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header Host $http_host;
          proxy_redirect off;
          proxy_pass http://app;
      }
  
      error_page 500 502 503 504 /500.html;
      client_max_body_size 4G;
      keepalive_timeout 10;
  }
  </code></pre>
  
  <p><em>Problem</em></p>
  
  <p>API requests (<code>POST /api/some_path/create</code> etc.) should be protected with two-way SSL.</p>
  
  <p>Only one service will use this API (only 1 client with one certificate)</p>
  
  <p><em>Question</em></p>
  
  <ol>
  <li>Does nginx able to handle <code>two-way SSL</code>?</li>
  <li><code>two-way SSL</code> should be implemented on <code>nginx</code>layer, not in web-application logic. am I right?</li>
  <li>How to set up <code>nginx</code> to catch clients which sends requests to <code>/api/...</code> url and authenticate them with <code>two-way SSL</code>?</li>
  </ol>
  
  <p>I just need a basic example, to understand how it should work.</p>