Basic auth and data from curl to HAProxy backend not working on TLS Termination - but works on TLS passthrough

listen pki
    bind *:8884 ssl no-sslv3 crt /HAPROXY.pem.ecdsa verify required ca-file /CA_CHAIN.pem
    mode http
    http-request add-header Content-Type "application/pkcs10"
    http-request add-header Content-Transfer-Encoding "base64"
    http-request add-header Authorization "Basic somebase64encodedstring"
    default_backend pkis_1
    
backend pkis_1
    mode http
    http-request add-header Content-Type "application/pkcs10"
    http-request add-header Content-Transfer-Encoding "base64"
    http-request add-header Authorization "Basic somebase64encodedstring"
    server pkis my.domain.com:443 ssl verify none

Using the above config we are able to call the backend successfully from curl on a certain endpoint, using the same certificates, but we are blocked on another endpoint of the same server which requires basic auth.

The curl call is:

curl --cacert '$INITIAL_CACERT' --key '$INITIAL_DEVICE_KEY' --cert '$INITIAL_DEVICE_CERT' --user '$USER':'$PWD' --data @'$1'/'$KEY_NAME'-key.b64 -o '$1'/'$KEY_NAME'-cert-p7.b64 -H "Content-Type: application/pkcs10" -H "Content-Transfer-Encoding: base64" https://'$PKI_SERVER':'$PORT'/.well-known/est/'$2'/simpleenroll

Is there some way to forward everything from this curl command to the backend?

The weird thing is , when we remove all ssl auth and switch to tcp mode as transparent proxy, the basic auth works!

I am not able to understand fully on your HAProxy confiugration but it looks like you are hardcoding headers for your backend. Instead I would add the HTTP headers from curl. Don't forget content-type, basic auth information are meant to be passed from the client as not all requests will have same content type or basic authentication. Check out answers from here on how to pass basic auth information in curl.

https://serversforhackers.com/c/using-ssl-certificates-with-haproxy

As the above article writes:

However, you lose the ability to add or edit HTTP headers, as the connection is simply routed through the load balancer to the proxied servers.

This means your application servers will lose the ability to get the X-Forwarded-* headers, which may include the client's IP address, port and scheme used.

So, I am realizing that it is not possible to propagate the required headers with TLS termination, and that's why the requests work when we play with TLS-passthrough mode!