2

TL;DR

I want to have "some thing" to handle client-certs on behalf a server that is unable to do it, for secure user authentication in addition to regular TLS encryption.

Context

In this question How can I double check security against a TLS on a public IP? the answers set clear that regular TLS does not typically do client authentication, although it seems it would be possible if the server requests it.

Let's suppose I have a server that is able to communicate via "plain text" or "on a TLS channel" (I can re-start the server with or without TLS), but if TLS is enabled, the server does not support checking client-certificates for auth.

The original question was for a docker registry, but I generalize the question to any server supporting TLS but not client-side certs.

What I'm thinking

I am thinking of offloading the "TLS part" to a security-specific software (much similar to what SSH port-forwarding tunnels are) and decouple the server and the TLS handling.

Probably there would be 2 processes involved:

  • The server listens in a firewalled localhost port or a linux socket in "plain text", but as it is firewalled it can never be reached from the outside.
  • Some kind of "security middleware" (Probably OpenSSL, but I'm not sure) -I think it'd be called a TLS terminator, but I'm neither really sure, too- to do this:
    • Handle the public-IP listening
    • Handle the server-side certs to secure the channel via TLS
    • Handle the client-side certs to check authenticity (probably against a set of public keys I'll have previously uploaded in the server)
    • If and only if the client belongs to a white-list of users, then forward the decrypted channel to the regualar plain-text server.

Questions

  1. Would be this TLS offloading a normal setup?

  2. If so, is OpenSSL a good handler for this offloading?

  3. If yes, what documentation could be a good starting point for this kind of setup, where I can read on and learn?

Thnx.

2
  • You won't receive a client certificate unless you ask for it. Your server can undoubtedly be configured to ask for it.
    – user207421
    May 2 '20 at 10:51
  • Cross-referenced here forums.docker.com/t/… May 2 '20 at 10:56
6
  1. Would be this TLS offloading a normal setup?

Offloading TLS to something else if your server doesn't support what you want is a normal setup.

  1. If so, is OpenSSL a good handler for this offloading?

I would not expect to build a solution for this directly with openssl. Load balancers do this sort of thing all the time. You can also do it with stunnel; here is an example setup, boiling down to these key config lines:

verify = 2 # This enables the mutual authentication
CAfile = /etc/ssl/certs/root-genfic.crt

Where client certs are signed by root-genfic.crt.

  1. If yes, what documentation could be a good starting point for this kind of setup, where I can read on and learn?

stunnel documentation and related resources are available at the stunnel web site.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.