Reusing client certificate for TLS proxy with nginx?

Florian Braun

4/26/24, 2:48 PM

I have a TCP application that uses mutual TLS to authenticate connecting clients.
Because of increased traffic I'd like to clusterize the application and load-balance the nodes with nginx. I already have that working with nginx's stream module, which (to my understanding) acts as a layer 4 balancer.

At this point it seems reasonable to me to drop connection attempts that fail the mTLS verification immediately at nginx, so the upstream nodes don't have to bother with them.
However, this means that I would have to terminate the TLS connection at nginx. Unfortunately my application relies on getting the client's identity from the verified client cert.

Is there any way to have the mTLS check at nginx, and then reusing the client certificate for the upstream connection?

For HTTP applications I have seen the workaround to terminate the TLS connection at nginx and pass the client cert as a custom header (e.g. proxy_set_header X-SSL-CERT $ssl_client_cert;), but that obviously wouldn't work in my case.

185

1 + 0

ssl

nginx

load-balancing

tcp

Score:1

Server

vidarlo

4/26/24, 5:21 PM

No, you can't do that. You can't both terminate the connection and keep it end-to-end.

But if you trust your proxy, your proxy can simply inject a header and use it's own client certificate to authenticate that the connection is trustworthy and initiated by a given client certificate.

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Reusing client certificate for TLS proxy with nginx?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.