Support obtaining client certificate for mTLS from HTTP header
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 31.7k
- Forks
- 8.3k
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 13
Description
Describe the feature you'd like to add to nginx
Enable nginx to obtain the client certificate used for mTLS (ssl_verify_client) from a configurable HTTP header, where the client certificate chain is represented by a URL encoded PEM format.
Describe the problem this feature solves
Our application utilizes client certificate authentication, presently performed by nginx. We need to utilize an external Web Application Firewall, which is capable of providing a client certificate it receives as an HTTP header without verifying it.
Additional context
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files, tests, or entry points. Start by reading nginx's existing mTLS handling and the linked AWS ALB mutual-authentication documentation; done means a configurable HTTP header can provide the URL-encoded PEM client certificate chain used by ssl_verify_client.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, nginx
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100