3

(Please note: this question is one of many "why don't you just try it?" questions. I certainly will, but since I haven't found an obvious answer by googling, I thought I might as well make it easier for someone who might need this later by asking on ServerFault)

My web application is served over HTTPS behind some load balancers and allows users to authenticate using client certificates in some cases. Now I'm being asked whether I'd like to offload SSL encryption/decryption to load balancers so that I'd be running a plain HTTP site (and thus with easier debugging and configuration) while the load balancer would be doing HTTPS for the users. Free extra CPU cycles certainly sound good, however, I'm not convinced that I'd still be able to check users' client certificates.

Is it possible to use client certificates without running a full-blown HTTPS site?

4

It depends how you use client certs to authenticate and authorise users. Do you allow anyone with a cert signed by someone you recognise or must it be signed and the CN equal something specific or equal a user in a group? Does your current web server handle authorisation or does your app?

The typical way to do this would be to terminate the SSL connection on a loadbalancer. This load balancer would be the "full-blown HTTPS site" and would need to be configured to request a client certificate. Your loadbalancer would then perform a check to see if the cert was signed by a trusted CA. The loadbalancer would then add details from the SSL cert, such as the DN, as HTTP Headers to plain HTTP request to your app. Your app would then check these HTTP headers and authorise the user based on a trust between the app and the loadbalancer. I've seen the accomplished with all major loadbalancers such as F5, ZXTM and even Apache HTTP Server.

  • In other words, it's not possible to do client certificate checks with HTTP only, but these checks could (and maybe even should) be offloaded to the load balancer. Correct? – Nikolai Prokoschenko Oct 12 '12 at 17:09
  • Correct, you can only ask for an SSL certificate during an SSL session. Using a loadbalancer to terminate the SSL and verify the client cert is signed is a good method although you need to understand if sensitive data will now be exposed and may violate compliancy rules. You also need to understand how the app "authorises" users. Good luck! – Alastair McCormack Oct 12 '12 at 22:24
-1

I am doing client certificate authorization (I am checking the claims like CN against a specific name) on my node js app.(using getPeerCertificate()).

I have hosted it on AWS EC2, also set up a domain for this. Everything works, but with a port 8082 at the back, like for eg, abc.example:8082/path. To remove this port number, I added a classic load balancer, but now I do not get the certificate to check if the claims are correct.

What am I doing wrong, or is there any other way?

  • Hello, this is rather a question than an answer. Feel free to ask antoher question if your setup is really different from original poster's. – bgtvfr Jun 25 at 9:36
  • 1
    Hi Priyanka, welcome to the community! If you have doubt yourself, and it wasn't answered through the OP's question, we advise you to ask your own question, this way you will have more chances of having a proper answer. – fboaventura Jun 25 at 15:16
  • It was definitely a question @bgtvfr. Anyways, I got this resolved. iptables is the solution – Priyanka Maharana Jun 26 at 10:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.