First, I hope that this is a legitimate question because it is spawned by what I am experiencing and what is happening. The environment is as follows... I have an apache reverse proxy, that I stood up in our lab, using mod_ssl. The reverse proxy is used to authenticate someone before accessing an application on my lab instance of Tomcat server. After authentication, mod_ssl forwards the DN from the PKI to a servlet on Tomcat using AJP.
The apache server uses a server cert created for me by my companies PKI team. And I'm using a user cert also provided by my company. Our company also issues us tokens and Smartcards for MFA. I have the CA certs also installed on the reverse proxy that are provided by my company. My server is running in a lab but can communicate with our enterprise LDAP. In our customer environment where this solution will be deployed they don't use smartcards, tokens or MFA. But for in-house testing I need to follow company architecture. Now to my question. What is going on during the client to reverse proxy handshake that is forcing the use of my smartcard? Generally the smartcard is only for digitally signing and authentication. So what is causing the exchange between a browser and my own reverse proxy to prompt me and require my smartcard? Is there something special in the certs that forces this requirement?
