Ssl – Is it possible to do client certificate authentication without running HTTPS on a webserver

certificatehttpsmod-sslssl

(Please note: this question is one of many "why don't you just try it?" questions. I certainly will, but since I haven't found an obvious answer by googling, I thought I might as well make it easier for someone who might need this later by asking on ServerFault)

My web application is served over HTTPS behind some load balancers and allows users to authenticate using client certificates in some cases. Now I'm being asked whether I'd like to offload SSL encryption/decryption to load balancers so that I'd be running a plain HTTP site (and thus with easier debugging and configuration) while the load balancer would be doing HTTPS for the users. Free extra CPU cycles certainly sound good, however, I'm not convinced that I'd still be able to check users' client certificates.

Is it possible to use client certificates without running a full-blown HTTPS site?

Best Answer

It depends how you use client certs to authenticate and authorise users. Do you allow anyone with a cert signed by someone you recognise or must it be signed and the CN equal something specific or equal a user in a group? Does your current web server handle authorisation or does your app?

The typical way to do this would be to terminate the SSL connection on a loadbalancer. This load balancer would be the "full-blown HTTPS site" and would need to be configured to request a client certificate. Your loadbalancer would then perform a check to see if the cert was signed by a trusted CA. The loadbalancer would then add details from the SSL cert, such as the DN, as HTTP Headers to plain HTTP request to your app. Your app would then check these HTTP headers and authorise the user based on a trust between the app and the loadbalancer. I've seen the accomplished with all major loadbalancers such as F5, ZXTM and even Apache HTTP Server.

Related Solutions

Ssl – Differences between IE6 and later with regard to HTTPS handling

Have you sniffed the client-to-server handshake between IE6 and the IIS machines yet? (http://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_handshake_in_detail) I suspect that this will give you the first bit of information about what's going wrong, especially if you compare the handshake to a working IE7-based client-to-server conversation. An incompatible handshake is my guess as to what's happening.

Here's Microsoft's "official" "changes to HTTPS in IE 7" document: http://msdn.microsoft.com/en-us/library/bb250503(VS.85).aspx

I'm wondering about the "Use TLS 1.0" checkbox in the "Advanced" settings of your IE6 clients. IE7 enables TLS 1.0 by default, and IE6 disables it. It's unclear if your Customer's pentesters played around with the settings on the servers, clients, or both. I can imagine that, assuming they were playing around with the servers, they disabled SSL v2 on the servers (see http://support.microsoft.com/kb/187498) but didn't tell anybody to enable TLS 1.0 on the IE6 clients.

On the servers, they would have altered/created the "Enabled" DWORD value under "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server" and set it to 0, assuming they did disable SSL v2.

Apache – Configuring SSL VirtualHosts on a Single IP with UCC/SAN Certificate

I tested this on my apache 2.2.14 instance and it worked fine:

Use the NameVirtualHost directive (to ports.conf):

NameVirtualHost *:443

define your vhosts:

<VirtualHost *:443>
  ServerName www.siteA.com
  DocumentRoot "/opt/apache22/htdocs/siteA"
  SSLCertificateFile "/path/to/my/cert"
  SSLCertificateKeyFile "/path/to/my/key"
</VirtualHost>
<VirtualHost *:443>
  ServerName www.siteB.com
  DocumentRoot "/opt/apache22/htdocs/siteB"
  SSLCertificateFile "/path/to/my/cert"
  SSLCertificateKeyFile "/path/to/my/key"
</VirtualHost>

I used this link as a resource.

Best Answer

Related Solutions

Ssl – Differences between IE6 and later with regard to HTTPS handling

Apache – Configuring SSL VirtualHosts on a Single IP with UCC/SAN Certificate

Related Topic