Caddy: Allow to extract fields from client cert (to set header for example)

[Alex131089]

This might be the same situation as #1904, duplicate of #1375, but I couldn't find an explicit issue about this. https://caddy.community/t/tls-authentication-with-client-cert/1074/7 eventually mention it.

Could it be possible to extract client certificate fields ?
To set them in a header, pass them to the underlying server for example, allowing simple authentification (but filtering this header for upstream, using header_upstream I suppose).

[francislavoie]

Out of curiosity, are other servers like nginx able to do this?

[Alex131089]

Yes, see the linked forum thread : https://nginx.org/en/docs/http/ngx_http_ssl_module.html#variables
Or https://httpd.apache.org/docs/2.4/ssl/ssl_howto.html#accesscontrol / https://httpd.apache.org/docs/2.4/mod/mod_ssl.html

[virtualdxs]

Has there been any progress on this? I had assumed at first that there was already a way to get the client's cert info, based on the 'verify_if_given' parameter (otherwise this parameter seems no better than not authenticating clients at all), but it seems this is not the case.

[virtualdxs]

It looks like this has actually been fixed in master. Can somebody confirm that this is a duplicate of #2115?

[francislavoie]

Yup, I think you're right @virtualdxs looks like a duplicate. Thanks for spotting that!