You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Duarte Silva <du...@serializing.me> on 2012/05/28 22:13:02 UTC

[users@httpd] Apache proxy sending client certificate on behalf of the client

Hi all,

I know this should be imposssible ("sounds" to me like a MITM), but bare with 
me for a second and please tell me if this is in any way possible:

Client (HTTPS request) -> Apache (Forward Proxy) -> Server (HTTPS)
                          \___________________/
                                   \/
                Sends the client certificate on behalf of
                               the client


Note that the client is able to create SSL connections but it is not able to 
send client certificate. Since the Apache is the one openning the connection 
to the end Server, isn't there a way to force Apache to send a specific client 
cert? I know the handshake is done in the Client even thought the server is 
opening the connection.

If it isn't, is there any alternatives that do this? Maybe if it was a 
transparent proxy?

Thanks for all your time, regards,
Duarte Silva

[users@httpd] Re: Apache proxy sending client certificate on behalf of the client

Posted by Duarte Silva <du...@serializing.me>.
Nevermind, got around the problem.

Thanks anyway, regards,
Duarte

On Monday 28 May 2012 21:13:02 Duarte Silva wrote:
> Hi all,
> 
> I know this should be imposssible ("sounds" to me like a MITM), but bare
> with me for a second and please tell me if this is in any way possible:
> 
> Client (HTTPS request) -> Apache (Forward Proxy) -> Server (HTTPS)
>                           \___________________/
>                                    \/
>                 Sends the client certificate on behalf of
>                                the client
> 
> 
> Note that the client is able to create SSL connections but it is not able to
> send client certificate. Since the Apache is the one openning the
> connection to the end Server, isn't there a way to force Apache to send a
> specific client cert? I know the handshake is done in the Client even
> thought the server is opening the connection.
> 
> If it isn't, is there any alternatives that do this? Maybe if it was a
> transparent proxy?
> 
> Thanks for all your time, regards,
> Duarte Silva