PassTLSClientCert
The PassTLSClientCert middleware adds the selected data from the passed client TLS certificate to a header.
Configuration Example
- Middleware PassTLSClientCert
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: test-passtlsclientcert
spec:
passTLSClientCert:
pem: true
info:
notAfter: true
notBefore: true
sans: true
subject:
country: true
province: true
locality: true
organization: true
organizationalUnit: true
commonName: true
serialNumber: true
domainComponent: true
issuer:
country: true
province: true
locality: true
organization: true
commonName: true
serialNumber: true
domainComponent: true
General Information
PassTLSClientCert can add two headers to the request:
X-Forwarded-Tls-Client-Certthat contains the pem.X-Forwarded-Tls-Client-Cert-Infothat contains all the selected certificate information in an escaped string.
info
X-Forwarded-Tls-Client-Cert-Infoheader value is a string that has been escaped in order to be a valid URL query.- These options only work accordingly to the MutualTLS configuration.
That is to say, only the certificates that match theclientAuth.clientAuthTypepolicy are passed.
Example of a complete certificate and explaining each of the middleware options
Configuration Options
| Field | Description | Default | Required |
|---|---|---|---|
pem | Fills the X-Forwarded-Tls-Client-Cert header with the certificate information.More information here. | false | No |
info.serialNumber | Add the Serial Number of the certificate.More information about info here. | false | No |
info.notAfter | Add the Not After information from the Validity part. More information about info here. | false | No |
info.notBefore | Add the Not Before information from the Validity part. More information about info here. | false | No |
info.sans | Add the Subject Alternative Name information from the Subject Alternative Name part. More information about info here. | false | No |
info.subject | The info.subject selects the specific client certificate subject details you want to add to the X-Forwarded-Tls-Client-Cert-Info header. More information about info here. | false | No |
info.subject.country | Add the country information into the subject.The data is taken from the subject part with the C key. More information about info here. | false | No |
info.subject.province | Add the province information into the subject.The data is taken from the subject part with the ST key. More information about info here. | false | No |
info.subject.locality | Add the locality information into the subject.The data is taken from the subject part with the L key. More information about info here. | false | No |
info.subject.organization | Add the organization information into the subject.The data is taken from the subject part with the O key. More information about info here. | false | No |
info.subject.organizationalUnit | Add the organizationalUnit information into the subject.The data is taken from the subject part with the OU key. More information about info here. | false | No |
info.subject.commonName | Add the commonName information into the subject.The data is taken from the subject part with the CN key. | false | No |
info.subject.serialNumber | Add the serialNumber information into the subject.The data is taken from the subject part with the SN key. | false | No |
info.subject.domainComponent | Add the domainComponent information into the subject.The data is taken from the subject part with the DC key. More information about info here. | false | No |
info.issuer | The info.issuer selects the specific client certificate issuer details you want to add to the X-Forwarded-Tls-Client-Cert-Info header. More information about info here. | false | No |
info.issuer.country | Add the country information into the issuer.The data is taken from the issuer part with the C key. More information about info here. | false | No |
info.issuer.province | Add the province information into the issuer.The data is taken from the issuer part with the ST key. More information about info here. | false | No |
info.issuer.locality | Add the locality information into the issuer.The data is taken from the issuer part with the L key. More information about info here. | false | No |
info.issuer.organization | Add the organization information into the issuer.The data is taken from the issuer part with the O key. More information about info here. | false | No |
info.issuer.commonName | Add the commonName information into the issuer.The data is taken from the issuer part with the CN key. More information about info here. | false | No |
info.issuer.serialNumber | Add the serialNumber information into the issuer.The data is taken from the issuer part with the SN key. More information about info here. | false | No |
info.issuer.domainComponent | Add the domainComponent information into the issuer.The data is taken from the issuer part with the DC key. More information about info here. | false | No |
pem
Data Format
The delimiters and \n will be removed.
If there are more than one certificate, they are separated by a ",".
Header size
The X-Forwarded-Tls-Client-Cert header value could exceed the web server header size limit
The header size limit of web servers is commonly between 4kb and 8kb.
If that turns out to be a problem, and if reconfiguring the server to allow larger headers is not an option,
one can alleviate the problem by selecting only the interesting parts of the cert,
through the use of the info options described below. (And by setting pem to false).
info
The info option selects the specific client certificate details you want to add to the X-Forwarded-Tls-Client-Cert-Info header.
Data Format
The value of the header is an escaped concatenation of all the selected certificate details. Unless specified otherwise, all the header values examples are shown unescaped, for readability.
If there are more than one certificate, they are separated by a ,.
The following example shows such a concatenation, when all the available fields are selected:
Subject="DC=org,DC=cheese,C=FR,C=US,ST=Cheese org state,ST=Cheese com state,L=TOULOUSE,L=LYON,O=Cheese,O=Cheese 2,CN=*.example.com";Issuer="DC=org,DC=cheese,C=FR,C=US,ST=Signing State,ST=Signing State 2,L=TOULOUSE,L=LYON,O=Cheese,O=Cheese 2,CN=Simple Signing CA 2";NB="1544094616";NA="1607166616";SAN="*.example.org,*.example.net,*.example.com,test@example.org,test@example.net,10.0.1.0,10.0.1.2"