3 ms·

Indeed, I was surprised when we tried to move a B2B application using mtls to http2 and realised that it simply was not implemented! I know that's not used a l

Indeed, I was surprised when we tried to move a B2B application using mtls to http2 and realised that it simply was not implemented! I know that's not used a lot but it is still used sometime when accessing critical systems. I suppose that in the long run, mtls will completely disappear because of that, strange for a protocol that advertise itself as more secure to remove this option.

p_l 5y ago
Client cert authentication (aka mutual tls) works perfectly fine on HTTP/2 (as it happens on a completely unrelated protocol layer), so my question is just what did you deploy that broke it?
- jiggawatts 5y ago
  It doesn't "just work", because it's a HTTP authentication flavour that happens to occur at the Transport layer. Because it crosses layers like this, HTTP has to know about the transport. For example, it's possible in HTTP 1.1 to have a page trigger cert auth even though the initial transport didn't use it! This is common for logging on to pages using Smart Cards but leaving an option to use alternate authentication modes. This was just... abandoned in HTTP/2 (and HTTP/3) as "too hard". Or more accurately, every authentication mode not used by Google was abandoned and does not work. I've tried HTTP/2 with products from numerous vendors, and without fail anything Google doesn't use... didn't work.
  - p_l 5y ago
    Are you talking about mutual TLS, or are you talking about Negotiate? Because the only way to trigger cert auth (under mtls) if the initial transport didn't use it is to force a TLS renegotiation, as it's handled by sending a CertificateRequest message at TLS layer. Windows Integrated Authentication however triggers authentication by sending Negotiate header and performing HTTP-level exchange. N.B. Every example of page triggering cert login later on that I have encountered in the wild forced a fresh connection and thus mutual authentication.

p_l 5y ago

Client cert authentication (aka mutual tls) works perfectly fine on HTTP/2 (as it happens on a completely unrelated protocol layer), so my question is just what did you deploy that broke it?

jiggawatts 5y ago
It doesn't "just work", because it's a HTTP authentication flavour that happens to occur at the Transport layer. Because it crosses layers like this, HTTP has to know about the transport. For example, it's possible in HTTP 1.1 to have a page trigger cert auth even though the initial transport didn't use it! This is common for logging on to pages using Smart Cards but leaving an option to use alternate authentication modes. This was just... abandoned in HTTP/2 (and HTTP/3) as "too hard". Or more accurately, every authentication mode not used by Google was abandoned and does not work. I've tried HTTP/2 with products from numerous vendors, and without fail anything Google doesn't use... didn't work.
- p_l 5y ago
  Are you talking about mutual TLS, or are you talking about Negotiate? Because the only way to trigger cert auth (under mtls) if the initial transport didn't use it is to force a TLS renegotiation, as it's handled by sending a CertificateRequest message at TLS layer. Windows Integrated Authentication however triggers authentication by sending Negotiate header and performing HTTP-level exchange. N.B. Every example of page triggering cert login later on that I have encountered in the wild forced a fresh connection and thus mutual authentication.