--- title: "Case Study: IPng's Client Certificates" url: https://daily.dev/posts/case-study-ipng-s-client-certificates-jv6uiq65h source_url: https://ipng.ch/s/articles/2026/06/27/case-study-ipngs-client-certificates type: article source: "IPng Networks" published: 2026-06-28T13:15:46.301Z updated: 2026-06-28T14:20:26.258Z tags: ["golang", "nginx"] reading_time: 26 upvotes: 4 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Case Study: IPng's Client Certificates **[IPng Networks](https://daily.dev/sources/ipngch)** · 26 min read · 4 upvotes · 0 comments ## Summary A detailed case study on building a custom mTLS-based authentication and authorization system for NGINX web frontends. The author describes `ipng-nginx-auth`, a three-component system: `authd` (central control plane with private CA, SQLite store, and gRPC API), `authz` (per-NGINX sidecar enforcing ACLs via NGINX's auth_request module), and `authc` (operator CLI). Long-lived client certificates are issued via a private CA and installed in browsers as PKCS#12 or Apple mobileconfig bundles. Authorization uses an OpenBSD pf.conf-inspired ordered ACL language with regex matching on host, URI, user DN, certificate serial, and IP prefix. The sidecar achieves ~110k req/s at 70µs median latency with 10 ACL rules. The system supports staged ACL commits, real-time policy propagation via gRPC streaming, Prometheus metrics, and selective per-request debug logging. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [TLS certificates for internal services done right](https://daily.dev/posts/tls-certificates-for-internal-services-done-right-yyfpvyhee) · Hacker News · 0 upvotes · 0 comments - [Native ACME Support Comes to NGINX](https://daily.dev/posts/native-acme-support-comes-to-nginx-z0jeewvpd) · Hacker News · 14 upvotes · 0 comments --- Tags: [#golang](https://daily.dev/tags/golang), [#nginx](https://daily.dev/tags/nginx) [View this post on daily.dev](https://daily.dev/posts/case-study-ipng-s-client-certificates-jv6uiq65h)