1

I added the client cert into ca.pem as in

bind 0.0.0.0:443 ssl crt /etc/ssl/private/asdf.hdavid.io.pem verify optional ca-file /etc/ssl/certs/ca.pem
http-request set-header X-SSL-Client-Verify        %[ssl_c_verify]

And then calling with curl -v --key key.pem --cert cert.pem https://asdf.hdavid.io

But I get X-SSL-Client-Verify as zero in the backend in both cases, when the client presents a valid certificate and when it presents a certificate not in haproxy trust

Actually it seems to work, with verify require haproxy properly blocks requests not coming from the certificate I trusted inside haproxy. But when I have verify optional. I always get ssl_c_verify as zero, why is that?

2
  • 1
    Make sure that ca.pem and cert.pem are actually the same. Make also sure that the certficate has basic constrains CA:true (check with openssl x509 -in cert.pem -text). If still a problem please provide enough information so that the problem can be reproduced, especially the exact way cert.pem and key.pem were created or simply the full content of these files. Commented Jun 28, 2021 at 15:38
  • they are the same. updated the question. Commented Jun 28, 2021 at 15:50

1 Answer 1

2

But when I have verify optional. I always get ssl_c_verify as zero, why is that?

Because this means successful validation. From the documentation of haproxy:

ssl_c_verify : integer
Returns the verify result error ID when the incoming connection was made over an SSL/TLS transport layer, otherwise zero if no error is encountered. Please refer to your SSL library's documentation for an exhaustive list of error codes.

This zero is basically X509_V_OK as documented in openssl verify.

But I get X-SSL-Client-Verify as zero in the backend in both cases, when the client presents a valid certificate and when it presents a certificate not in haproxy trust

I cannot reproduce this. When the client presents a certificate which is not trusted the connection will fail since the verification fails:

$ curl ... -cert wrong.pem ...
...
* OpenSSL SSL_read: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca, errno 0

But when no certificate is presented the connection will succeed, since the client certificate is considered optional.

But it looks like you want the connection to actually succeed with the wrong certificate, but to forward the error upstream. And you also want to forward the information if a client certificate was used in the first place. In this case you might use something like this:

bind 0.0.0.0:443 ssl ... verify optional crt-ignore-err all ...
http-request set-header X-SSL-Client-Verify   %[ssl_c_verify]
http-request set-header X-SSL-Client-Used     %[ssl_c_used]

The X-SSL-Client-Used header will then be 1 if a client certificate was given. The X-SSL-Client-Verify will be 0 if no error happened during certificate validation, which includes the case that no certificate was given. Otherwise it will return the verification error.

2
  • I've updated my question, sorry my english was not helping me here. Commented Jun 28, 2021 at 18:05
  • @DavidHofmann: see updated answer Commented Jun 28, 2021 at 19:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .