First, I hope that this is a legitimate question because it is spawned by what I am experiencing and what is happening. The environment is as follows... I have an apache reverse proxy, that I stood up in our lab, using mod_ssl. The reverse proxy is used to authenticate someone before accessing an application on my lab instance of Tomcat server. After authentication, mod_ssl forwards the DN from the PKI to a servlet on Tomcat using AJP.

The apache server uses a server cert created for me by my companies PKI team. And I'm using a user cert also provided by my company. Our company also issues us tokens and Smartcards for MFA. I have the CA certs also installed on the reverse proxy that are provided by my company. My server is running in a lab but can communicate with our enterprise LDAP. In our customer environment where this solution will be deployed they don't use smartcards, tokens or MFA. But for in-house testing I need to follow company architecture. Now to my question. What is going on during the client to reverse proxy handshake that is forcing the use of my smartcard? Generally the smartcard is only for digitally signing and authentication. So what is causing the exchange between a browser and my own reverse proxy to prompt me and require my smartcard? Is there something special in the certs that forces this requirement?

  • 1
    My guess is that your reverse proxy is configured to request authentication with a client certificate. This is not a property of the servers certificate but of the servers configuration. Check SSLVerifyClient setting in your reverse proxy. – Steffen Ullrich Apr 26 '18 at 5:37
  • I checked and SSLVerifyCertificate is commented out – bbboomer Apr 26 '18 at 17:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.