Questions tagged [client-certificate]

A certificate which authenticates a client or user towards a server or service.

Filter by
Sorted by
Tagged with
0
votes
0answers
41 views

CRL revocation check fails yet can retrieve file

I have an IIS server on a 2016 box (IIS v10 it says) which is being used to authenticate a unix server via a certificate. I have confirmed connectivity to the internal CRL server, I can telnet to it, ...
2
votes
1answer
66 views

Postfix client cert info not being passed to opendkim milter

I have a private postfix server that uses dovecot sasl to optionally authenticate submission clients, and I'm trying to set it up to also accept client certificates to allow it to act as a relay host ...
-1
votes
1answer
105 views

MTLS on Nginx that works with client side Android Apps?

Is there a way to pull off MTLS/Two-Way SSL/Client Certificates that work on unrooted v10+ Android Clients on the cheap? I have a couple of personal api end points that I want to be publicly ...
0
votes
0answers
41 views

Debug client certificate authentification in Firefox

I'm having trouble determining why Firefox is not applying client certificate authentification in a particular situation. I have a self-signed client certificate issued for a specific site (nginx ...
0
votes
1answer
82 views

X-ARR-ClientCert not passing from Azure Web App Reverse proxy to another Azure Web App

I've setup a reverse proxy in an Azure Web App instance that's rewriting the URL and forcing SSL to our main Azure Web App .NET Application. It's been running well. We want to deploy client ...
1
vote
0answers
106 views

NGINX Client Certificate with Indirect CRL

I'm trying to implement mTLS using Nginx SSL Module. Everything works fine until I give Nginx CRL files concatenated in PEM format because one of the CRL is an Indirect CRL. The chain for a leaf ...
2
votes
1answer
125 views

Lighttpd Client Certificate Authentication

I'm trying to enable client certificate authentication with lighttpd using my own internal windows CA's. Disclaimer: I'm still very new to PKI :D I have an offline root CA and a subordinate CA in my ...
0
votes
0answers
21 views

How to prevent browser from prompting for a client certificate without disabling client certificates (IIS)

I have a .NET Framework Web API deployed to IIS which supports client certificate and token based authentication. When my user logs into the GUI and calls the API with a valid token (via javascript) ...
0
votes
1answer
84 views

Overriding “SSL client : No” for a specific nginx vitual server

I have a bunch of clients (too many to easily retrofit) each holding a single certificate (signed by a non-standard CA over which I have no control; I just generated the CSRs). Now I need to setup a &...
0
votes
0answers
190 views

Nginx reverse proxy with client-certificate authentication

I understand I can have nginx to check client certificate before forwarding requests; something along the lines: server { listen 443 ssl; server_name my.server.com; ssl_certificate /...
0
votes
0answers
65 views

Loki docker logging plugin with client certificate authentication

I'm trying to figure out, how to use loki docker logging plugin with client certificate authentication. Should be possible by setting loki-tls-cert-file, but I get all the time: ERROR: for ...
0
votes
1answer
544 views

HTTP authentication with public/private key pair

I'm looking for a way to authenticate clients/users at a web server with public/private key pairs and already read this question: Public key authentication or similar over HTTP/HTTPS? The answers are ...
0
votes
1answer
32 views

Choose Client Certificate dialog in FF displays only a subset of available client certs

problem: We have an application here using client certificate authentication. This has been working without any issues for years, but now several clients are experiencing the following issue in FF and ...
2
votes
1answer
302 views

Configure NGINX reverse proxy to verify client certificate custom field

I would like to verify a client certificate "custom" field directly with NGINX before returning it to the actual page. As I understand from here: http://nginx.org/en/docs/http/ngx_http_ssl_module....
1
vote
0answers
492 views

How to add checks for multiple specific ssl_client_fingerprints in Nginx configuration?

In addition to usual CA chain validation, I would like Nginx server section to permit specific client certificate thumbprints only. I could find how to check for single fingerprint, but I'm not sure ...
0
votes
0answers
662 views

Deployed certificate to Personal store using GPO

I am trying to find a user GPO to install a certificate in the personal store (this is a browser certificate and if installed in other stores it won't work so it has to be installed in the Personal ...
0
votes
1answer
418 views

OCSP client certificate validation

For a home automation project I have created an API (written in ASP.NET so hosted in IIS) and written my own Android app to communicate with this API. To prevent people from accessing specific ...
6
votes
1answer
3k views

How does one forward a client authentication certificate through HA proxy while terminating TLS?

I have a web API fronted by an HA Proxy load balancer. The web API uses client authentication certificates for identity authentication and authorization. I'd like the HA Proxy appliance to terminate ...
0
votes
0answers
136 views

apache/php not getting client certificates

We wanted to use client certificates in browsers for some of our users for machine identification. I set up a CA and and signed a client certificate which I installed in chrome. Then I set the ...
2
votes
1answer
3k views

Add Client Certificate when acting as a reverse proxy

I basically have the exact same problem as Add Client certificate when acting as reverse proxy (Apache/NGINX) , but in my case there is no nginx that can help me out. I want a certain location inside ...
5
votes
1answer
2k views

AWS API Gateway Lambda Authorizers + Client certificates

I'm evaluating the use of client certificatates to improve security in an application i'm working on. It all run behind on AWS and pass through an API Gateway with an attached Lambda authorizer. AWS ...
0
votes
0answers
66 views

Is there a way to configure IIS to tell us we received an untrusted client certificate?

We have a Web API endpoint configured to allow, but not require, client certificates. We're logging the certificate we receive, then checking to make sure it is what we expect, logging the result, ...
4
votes
1answer
1k views

Debugging client certificate issues on IIS

We have an 2008R2 IIS server set up with a site configured to require client certificates. Our test client isn't working, and we're trying to debug why. During the course of this, we've set up a new ...
0
votes
0answers
41 views

Assigning third-party client certificates/keys to Active Directory users

In our organization, we have a number of third-party vendors that we must interact with using client certificates. We'd like to be able to assign certificates/keys to a particular Active Directory ...
0
votes
1answer
764 views

Is a windows user really needed for IIS client certificate authorization, if so how to set this user's privileges?

I had originally posted this question in securitystackexchange, but I didn't get the answer I was expecting, and I see the topic can also fit here. I need to connect two servers in different ...
0
votes
1answer
6k views

curl - SSL peer does not support certificates of the type it received

Trying to send a request with a client certificate to an Apache server, I have the following request and error: $ curl -X POST https://my-server.com/dummy/user -H 'Cache-Control: no-cache' -H '...
1
vote
1answer
4k views

List all client certificates installed on user profiles in a domain

I'm taking initial steps to start securing a network, and I've come across the fact that a number of machines have Client Certificates for websites installed in the user client certificate store, ...
1
vote
1answer
331 views

Nginx: Change value of `ssl_verify_client` based on request IP

When setting up nginx with client-certificate config, ssl_verify_client should be set to on or optional. If we want to bypass verification for local users (like 192.168.0.0/24), we can use optional ...