3 ms·
The other challenge is proxies. When the backend that cares about client cert is behind a proxy you need to dig into the less-familiar parts of the proxy and tr
by aragilar 1y ago
The other challenge is proxies. When the backend that cares about client cert is behind a proxy you need to dig into the less-familiar parts of the proxy and try to work out either how to pass the certificate on or extract the information from it.
- jeroenhd 1y agoThe typical solution for reverse proxies is to extract the relevant information and pass it on as either custom headers or environment variables. That works fine, assuming you make sure to ignore the headers the client might send to take that information, of course. It's pretty easy to set up in Apache and Nginx at least. For forward proxies, the only option is to either accept the connection unaltered or to drop the connection entirely.
- aragilar 1y agoYeah, it's not bad when the backend will accept headers (e.g. remote_user), it's when it wants the actual certificate to check against a CA when it becomes an issue.