Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of covener@gmail.com designates
 209.85.217.173 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <1596659.yLNDsHBpAc@estarola>
References: <1596659.yLNDsHBpAc@estarola>
Date: Mon, 28 May 2012 16:02:44 -0400
Message-ID: 
 <CALK=YjMLDnVnOdK1mfcJyM3anYrxc_Fnz_rJfEAGiK5Og00pnA@mail.gmail.com>
Subject: Re: Apache proxy sending client certificate on behalf of the client
From: Eric Covener <covener@gmail.com>
To: dev@httpd.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On Mon, May 28, 2012 at 3:53 PM, Duarte Silva
<duarte.silva@serializing.me> wrote:
> Hi all,
>
> I know this should be imposssible ("sounds" to me like a MITM), but bare =
with
> me for a second and please tell me if this is in any way possible:
>
> Client (HTTPS request) -> Apache (Forward Proxy) -> Server (HTTPS)
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0\___________________/
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 \/
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0Sends the client certificate on behalf of
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 the client
>
>
> Note that the client is able to create SSL connections but it is not able=
 to
> send client certificate. Since the Apache is the one openning the connect=
ion
> to the end Server, isn't there a way to force Apache to send a specific c=
lient
> cert (the handshake is done in the Client even though the server is?
>
> If it isn't, is there any alternatives that do this? Maybe if it was a
> transparent proxy?
>

http://httpd.apache.org/userslist.html