title: client certificate forwarding from haproxy to tomcat
body: <p>I've been using httpd to offload my SSL processing and forward http requests to tomcat via AJP. I'm now moving to haproxy instead of httpd and HTTP instead of AJP. I am able to connect to haproxy via https and see an appropriate http request arrive at tomcat. when trying to verify the client certificate my tomcat code cannot retrieve the CN from the certificate. I added the following lines to haproxy.cfg in the hope that it will forward the client certificate information in the http header:</p>
  
  <pre><code>http-request set-header X-SSL                       %[ssl_fc]
  http-request set-header X-SSL-Client-Verify         %[ssl_c_verify]
  http-request set-header X-SSL-Client-SHA1           %{+Q}[ssl_c_sha1]
  http-request set-header X-SSL-Client-DN             %{+Q}[ssl_c_s_dn]
  http-request set-header X-SSL-Client-CN             %{+Q}[ssl_c_s_dn(cn)]
  http-request set-header X-SSL-Issuer                %{+Q}[ssl_c_i_dn]
  http-request set-header X-SSL-Client-Not-Before     %{+Q}[ssl_c_notbefore]
  http-request set-header X-SSL-Client-Not-After      %{+Q}[ssl_c_notafter]
  </code></pre>
  
  <p>looking at the capture file for the http connection I see the following http header:</p>
  
  <pre><code>GET /api/subscriber/count?_=1511258656303 HTTP/1.1
  Host: 192.168.20.192
  Accept: */*
  X-Requested-With: XMLHttpRequest
  User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36
  Referer: https://192.168.20.192/dashboard.jsp
  Accept-Encoding: gzip, deflate, br
  Accept-Language: en-US,en;q=0.8,he;q=0.6
  Cookie: gsScrollPos-1158=0; gsScrollPos-536=0; gsScrollPos-873=2579; gsScrollPos-2263=0; gsScrollPos-472=0; gsScrollPos-468=; JSESSIONID=B433B96FB2616A8447703BFAE541DC2C
  X-SSL: 1
  X-SSL-Client-Verify: 0
  X-SSL-Client-SHA1: 
  X-SSL-Client-DN: 
  X-SSL-Client-CN: 
  X-SSL-Issuer: 
  X-SSL-Client-Not-Before: 
  X-SSL-Client-Not-After: 
  X-Forwarded-Proto: https
  X-Forwarded-For: ::ffff:192.168.12.171
  Connection: close
  </code></pre>
  
  <p>as you can see the certificate information is blank.</p>
  
  <p>Am I doing something wrong? is there something else needed to pass the certificate to tomcat?
  alternatively can this be made to work using AJP?</p>
  
  <p>here is my full haproxy.cfg:</p>
  
  <pre><code>global
      log         127.0.0.1 local4
  
      chroot      /var/lib/haproxy
      pidfile     /var/run/haproxy.pid
      maxconn     4000
      user        haproxy
      group       haproxy
      daemon
  
      # turn on stats unix socket
      stats socket /var/lib/haproxy/stats
  
      # ssl ciphers and options
      ssl-default-bind-options no-sslv3
      ssl-default-bind-ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:ECDH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
      tune.ssl.default-dh-param 2048
  
  #---------------------------------------------------------------------
  # common defaults that all the 'listen' and 'backend' sections will
  # use if not designated in their block
  #---------------------------------------------------------------------
  defaults
      mode                    http
      log                     global
      option                  httplog
      option                  dontlognull
      option http-server-close
      option forwardfor       except 127.0.0.0/8
      option                  redispatch
      retries                 3
      timeout http-request    10s
      timeout queue           1m
      timeout connect         10s
      timeout client          1m
      timeout server          1m
      timeout http-keep-alive 10s
      timeout check           10s
      maxconn                 3000
  
  frontend https
      mode http
      bind :::443 ssl crt /opt/vasona/CA/private/sa_bundle.pem ca-file /opt/vasona/CA/certs/crtServer.crt verify optional
  
  
      http-request set-header X-SSL                       %[ssl_fc]
      http-request set-header X-SSL-Client-Verify         %[ssl_c_verify]
      http-request set-header X-SSL-Client-SHA1           %{+Q}[ssl_c_sha1]
      http-request set-header X-SSL-Client-DN             %{+Q}[ssl_c_s_dn]
      http-request set-header X-SSL-Client-CN             %{+Q}[ssl_c_s_dn(cn)]
      http-request set-header X-SSL-Issuer                %{+Q}[ssl_c_i_dn]
      http-request set-header X-SSL-Client-Not-Before     %{+Q}[ssl_c_notbefore]
      http-request set-header X-SSL-Client-Not-After      %{+Q}[ssl_c_notafter]
      reqadd X-Forwarded-Proto:\ https
      default_backend tomcat-mgmt
  
  backend tomcat-mgmt
      mode http
      option tcp-smart-connect
      server tomcat :8009
  
  backend tomcat-cp-events
      mode http
      option tcp-smart-connect
      server tomcat :23237
  </code></pre>
  
  <p>please let me know if any other info is needed. 
  Thanks,
  Gidon</p>