Is there a way to add a exception for mTLS?

General
1

Here is my current config:

(mtls) {
        tls {
                client_auth {
                        trust_pool file /etc/caddy/darincrt.pem
                }

        }
}

What I would like to do is add a exception for a range of IP addresses. Right now mTLS auth is required from all sources which isn’t ideal.

2

Just spitballing:

(mtls) {
        tls {
                client_auth {
                        mode verify_if_given
                        trust_pool file /etc/caddy/darincrt.pem
                }

        }
}

Then create a named matcher, for example:

@block_access {
    not vars_regexp {http.request.tls.client.issuer} ^.+$
    not remote_ip ALLOWED_IP_ADDRESSES
}

handle @block_access {
    respond 403
}
3 Likes
3

I just tested this and it works as expected:

  • If the client presents a certificate, it has to pass validation.
  • If the client doesn’t present a certificate, then its IP address is checked instead.
2 Likes
4

Is there a way to do this in pure layer 4? (as in during the TLS handshake)

5

You can use abort instead of respond 403.

2 Likes