We’ve setup nginx ingress with mTLS enabled and we do observe that it’s working fine,
However, we have a use case:
1, we have nginx-ingress(mtls enabled, ssl_verify_client=optional) with proxy-pass working in region Acme1, we can see the client certificate when “direct” hit with SSL Client Certificate and SSL Key Certificate passed on
2, we have nginx-ingress(mtls enabled, ssl_verify_client=optional) with proxy-pass working in region Acme2, we can see the client certificate when “direct” hit with SSL Client Certificate and SSL Key Certificate passed on
-
in Acme1 nginx-ingress, we add “failover” mechanism to Acme2 nginx-ingress, we confirm everything is working good and legit.
-
Before setting ssl_verify_client=on on both Acme1 and Acme2, in Acme1, added these below lines
proxy_ssl_session_reuse on;
proxy_ssl_certificate certs/ca.crt;
proxy_ssl_certificate_key certs/key.crt;
proxy_ssl_trusted_certificate certs/rootca.pem;
as well as under “/location”, included below lines
proxy_ssl_session_reuse on;
proxy_set_header X-SSL-CERT $ssl_client_escaped_cert;
proxy_set_header X-Client-Cert $ssl_client_escaped_cert;
And in ACME2, we observe that we are seeing certificate as per proxy_ssl_certificate/proxy_ssl_certificate_key/proxy_ssl_trusted_certificate (that is forwarded from ACME1 nginx only) when spillover/failover happens from Acme1 Nginx-ingress. How do we be able to completely forward the client certificate when hit at ACME1 and spillover/failover to ACME2?
ACME2 have this below already
nginx.ingress.kubernetes.io/auth-tls-secret: root-ca
nginx.ingress.kubernetes.io/auth-tls-verify-client: "on"
nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream: "true"
nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream-header: "x-forwarded-client-cert"
nginx.ingress.kubernetes.io/auth-tls-verify-depth: "2"
Expecting what should be tweaked in order to completely forward client certificate when hit to ACME1 nginx and be able to include in ACME2 nginx.