Forward Client Authentication Certificate Through HAProxy

certificateclient-certificatehaproxy

I have a web API fronted by an HA Proxy load balancer. The web API uses client authentication certificates for identity authentication and authorization. I'd like the HA Proxy appliance to terminate the TLS connection and use normal HTTP on the backend to talk to the web API, but I need the client authentication certificate passed through over the HTTP connection. How does the HA Proxy need to be set up to keep the authentication certificate on the request out the backend, but using HTTP only?

Best Answer

You can set various HTTP headers to be sent to the backend regarding the TLS client certificate that was presented. For example:

frontend intranet
    bind 10.20.30.40:443 ssl crt /etc/haproxy/pem/server.pem ca-file /etc/haproxy/pem/client-chain.pem verify required
    http-request set-header X-SSL                       %[ssl_fc]
    http-request set-header X-SSL-Client-Verify         %[ssl_c_verify]
    http-request set-header X-SSL-Client-SHA1           %{+Q}[ssl_c_sha1]
    http-request set-header X-SSL-Client-DN             %{+Q}[ssl_c_s_dn]
    http-request set-header X-SSL-Client-CN             %{+Q}[ssl_c_s_dn(cn)]
    http-request set-header X-SSL-Issuer                %{+Q}[ssl_c_i_dn]
    http-request set-header X-SSL-Client-Not-Before     %{+Q}[ssl_c_notbefore]
    http-request set-header X-SSL-Client-Not-After      %{+Q}[ssl_c_notafter]
    default_backend your_backend

Your application must then examine the headers and take appropriate action.

This example was taken from raymii.org where you may find some additional useful information about using client certificates with HAProxy, such as validating the client certificate and rejecting invalid certificates.

Related Topic