1

We're using a load balancer, which implements TLS interception for a server, which in turn uses TLS Client authentication. Since TLS interception implies that the client will make the connection to the load balancer, not the server itself directly, will this affect the authentication process?

2

Since the TLS connection will be terminated by the TLS proxy the authentication of the client via client certificates will be terminated there too. Since the TLS proxy does not have the private key of the client it will not be able to use the original certificate of the client when connecting with TLS to the final server.

The only way to pass the clients original certificate or information about it are thus outside of TLS, for example by inserting some fields into the HTTP request header as described here for HAproxy. The server or web application then needs to check these fields at the application level instead of relying on client certificate validation at the TLS level.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.