How does one forward a client authentication certificate through HA proxy while terminating TLS?

Matt Hamsmith asked:

I have a web API fronted by an HA Proxy load balancer. The web API uses client authentication certificates for identity authentication and authorization. I’d like the HA Proxy appliance to terminate the TLS connection and use normal HTTP on the backend to talk to the web API, but I need the client authentication certificate passed through over the HTTP connection. How does the HA Proxy need to be set up to keep the authentication certificate on the request out the backend, but using HTTP only?

My answer:

You can set various HTTP headers to be sent to the backend regarding the TLS client certificate that was presented. For example:

frontend intranet
    bind ssl crt /etc/haproxy/pem/server.pem ca-file /etc/haproxy/pem/client-chain.pem verify required
    http-request set-header X-SSL                       %[ssl_fc]
    http-request set-header X-SSL-Client-Verify         %[ssl_c_verify]
    http-request set-header X-SSL-Client-SHA1           %{+Q}[ssl_c_sha1]
    http-request set-header X-SSL-Client-DN             %{+Q}[ssl_c_s_dn]
    http-request set-header X-SSL-Client-CN             %{+Q}[ssl_c_s_dn(cn)]
    http-request set-header X-SSL-Issuer                %{+Q}[ssl_c_i_dn]
    http-request set-header X-SSL-Client-Not-Before     %{+Q}[ssl_c_notbefore]
    http-request set-header X-SSL-Client-Not-After      %{+Q}[ssl_c_notafter]
    default_backend your_backend

Your application must then examine the headers and take appropriate action.

This example was taken from where you may find some additional useful information about using client certificates with HAProxy, such as validating the client certificate and rejecting invalid certificates.

View the full question and any other answers on Server Fault.

Creative Commons License
This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.