Ssl – Linux forward proxy for client authentication

PROXYsslssl-certificate

I need to use a simple HTTP forward proxy proxy for Linux to do mutual SSL authentication.
The proxy needs to attach a client certificate to HTTP request and then upgrade HTTP to HTTPS.

I have tried to do that with Nginx, Apache only to reach a dead end.

https://superuser.com/questions/604352/nginx-as-forward-proxy-for-https?rq=1

http://apache-http-server.18135.x6.nabble.com/How-to-pass-a-Client-Certificate-through-a-Reverse-Proxy-td4754227.html

I tried squid but it's too complicated in installation and configuration.

What should I go for (I don't mind commercial software or free ones)?

Best Answer

I don't see a reason to connect first using an insecure protocol and redirect to HTTPS afterwards.

The way this is done using the apache web server is quite simple, you can use any of the fields of the client certificate to authenticate your users:

Require              ssl-verify-client
SSLRequireSSL
SSLOptions           +FakeBasicAuth +StrictRequire
SSLRequire           %{SSL_CIPHER_USEKEYSIZE} >= 256
SSLRequire           %{SSL_CLIENT_S_DN_O} eq "Awesome Company" \
                 and %{SSL_CLIENT_S_DN_OU} eq "Development" \
                 and %{SSL_CLIENT_S_DN_CN} in {"John Doe", "Jane Doe"}

Read the online documentation for further guidance.

Related Topic