Subject: SSLProxy - Howto delegate Client Certificate to backend server

From: [email-masked]
Date: Fri, 21 Feb 2003 07:39:07 +0100

Hi all,

I have the following scenario:

Apache webserver 2.0.44 with mod_ssl requires client authentication during
SSL handshake
for a particular URL. All further requests coming in over the established
SSL connection are
delegated to a backend server. The connection between the webserver and the
backend
server is also configured to be a SSL connection with client
authentication, so the webserver
has to provide a client certificate to the backend server.

I'd like to pass the client certificate provided by the end user to the
backend server. Is there a
chance to do this with mod_ssl?

Any help and comments appreciated.

Best regards
Ulrich
____________________________________________________________________________

Deutscher Sparkassen Verlag GmbH

Am Wallgraben 115
70565 Stuttgart
Telefon: 0711/782-0
Webseite: http://www.dsv-gruppe.de
____________________________________________________________________________

Dieses E-Mail einschließlich evtl. angehängter Dateien enthält vertrauliche
und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige
Adressat sind und Sie dieses E-Mail irrtümlich erhalten haben, dürfen Sie
weder den Inhalt dieses E-Mails nutzen noch dürfen Sie die evtl.
angehängten Dateien öffnen und auch nichts kopieren oder
weitergeben/verbreiten.
Bitte verständigen Sie den Absender und löschen Sie dieses E-Mail und evtl.
angehängte Dateien umgehend. Vielen Dank!
____________________________________________________________________________

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Mads Toftum <[email-masked]>
Date: Sun, 23 Feb 2003 17:14:04 +0100

> chance to do this with mod_ssl?
Currently there isn't a solution with mod_ssl. There is however a couple
of ways to do this if you don't mind hacking the code. I made a POC module
for Apache 1.3 http://www.toftum.org/www2/apache/ which is just a very
simple example of how this can be done. There has also been sent a patch
to the dev@httpd list recently - they have not been included, but see 
http://marc.theaimsgroup.com/?t=104499235500006&r=1&w=2

vh

Mads Toftum
-- 
`Darn it, who spiked my coffee with water?!' - lwall

---

From: Maik Mueller <[email-masked]>
Date: Wed, 26 Feb 2003 04:34:41 +0100

Hello ulrich,

Friday, February 21, 2003, 7:39:07 AM, you wrote:

uldgd> I have the following scenario:
uldgd> Apache webserver 2.0.44 with mod_ssl requires client authentication during
uldgd> SSL handshake
uldgd> for a particular URL. All further requests coming in over the established
uldgd> SSL connection are
uldgd> delegated to a backend server. The connection between the webserver and the
uldgd> backend
uldgd> server is also configured to be a SSL connection with client
uldgd> authentication, so the webserver
uldgd> has to provide a client certificate to the backend server.

uldgd> I'd like to pass the client certificate provided by the end user to the
uldgd> backend server. Is there a
uldgd> chance to do this with mod_ssl?
I believe everything you are looking for is in the patch I posted on
Wed, 19 Feb 2003 (RE: Patches and Enhancements for a SSL-Proxy Based
on Apache 2.0 (mod_ssl, mod_proxy, mod_headers)).
If you find my patch useful I would appreciate any help to make it
part of future Apache distributions.

-- 
Best regards,
 Maik                            mailto:[email-masked]