CODEWITHSUNDEEP
apachespring-securitycertificate
Kevin Meredith
Kevin Meredith

Reputation: 41939

Putting X509 Certificate in HTTP Request

I'm using Spring Security for X.509 preauthentication.

To make sure the client sends its certificate per HTTP request, is it necessary to:

Based on reading, the web server must tell the client-side to sends its certificate in order for the client to actually send it. I'm confused if Spring Security AND Apache configuration is required to achieve this.

Upvotes: 1

Views: 4718

Answers (1)

Shaun the Sheep
Shaun the Sheep

Reputation: 22762

Spring Security configuration has nothing to do with whether the client sends a certificate or not. That's decided at the SSL protocol level and hence by the negotiation between the client and the server. Your question is a bit unclear in that it refers to a maven pom and an Apache configuration without explaining how your system is set up. Are you running the maven Jetty plugin with an Apache server in front?

Spring Security's X.509 authentication won't work if the SSL connection doesn't terminate at the servlet container. So if you have HTTPS between the client and Apache, and a non-SSL connection from Apache to the servlet container, then the client certificate won't normally be available.

If you are using an AJP connector, then you can configure Apache to pass the certificate on to the back end using the ExportCertData option. If you aren't, you can still take the exported certificate and pass it as a request header (you'll find examples of this elsewhere on SO). You would also need to customize the Spring Security X.509 code to extract the certificate from the header, rather than the standard java property name which it uses by default.

Upvotes: 4

Related Questions