SSL Mutual-Authentication

[zero-x-baadf00d (Thibault)]

Hello,

We are looking to migrating from Nginx to Caddy but we can’t found how to forward client SSL certificate information to the backend. The kind of authentication is a standard in bank or financial domains.

With Nginx, we can get information like

proxy_set_header X-ClientSSL-Status $ssl_client_verify;  //  “SUCCESS”, “FAILED:reason”, or “NONE”
proxy_set_header X-ClientSSL-DN $ssl_client_s_dn;  // The subject DN
proxy_set_header X-ClientSSL-Finger $ssl_client_fingerprint;  // The certificate fingerprint

How to pass same data to backend with Caddy ?

Thanks

[Whitestrake (Matthew Fay)]

The short answer is that the data isn’t available through configuration, yet. Caddy would need to be modified in order to make it available.

Here’s the thread from the last time a similar question was raised:

TLS: authentication with client cert

With NGINX I can require clients certificate and use info from it to e.g. set certain headers: ssl_verify_client on; ... proxy_set_header X-DN $ssl_client_s_dn; So there are number of Embedded Variables in NGINX module (Module ngx_http_ssl_module). With Caddy I can use tls [cert key] { clients [request|require|verify_if_given|] clientcas... } But the question: are there any {placeholders} for cert’s info ? (I couldn’t find it in the source but that can be because my lack of Go knowle…

[zero-x-baadf00d (Thibault)]

Ok, is this modification was on your roadmap ? any ETA ? Currently, SSL Authentication seems useless if we can identify one client from other.

Thanks

[matt (Matt Holt)]

Yeah, this recently became possible with the release of Go 1.8; the unchecked item in https://github.com/mholt/caddy/issues/1375 is what you’re looking for.

It just requires some parameters added to the tls directive of the Caddyfile and then implementing that callback function mentioned in the issue. I think.

Feel free to contribute a pull request! Or I will get around to it eventually.