stephenloggedon

Is it possible to force the client to provide a cert to establish a connection? (mTLS)

Hello

I’m trying to learn some basic Phoenix stuff by writing a backend API and I am having trouble implementing client auth via mTLS. Maybe I am missing something about how mTLS works, but I can’t manage to force the server to authenticate the client. Is it actually possible to force the client to provide a cert to establish a connection?

I’m just using self signed certs, by the way.

9 comments

/phoenix #cowboy #bandit

0 858 9

2024-06-17 15:16:03 UTC

Most Liked

tangui

If you’re thinking about RFC8705 the plug already exists: APIacAuthMTLS

Post #4

voltone

The server can request that the client provide a certificate. The client can choose to submit a certificate as part of the handshake in response to such a request, but it will never send a certificate if the server didn’t ask for it.

Some servers terminate the TLS handshake if the client did not provide a valid certificate, others allow the handshake to continue and return an error in a higher protocol layer (e.g. return a 403 HTTP response).

It is not clear from your question whether the Phoenix app is the server or the client, and what is on the other end.

Keep in mind that convincing Erlang’s ssl module to accept self-signed certificates requires customising the verification logic, as by default it will want to check the certificate against a set of trusted CAs instead.

Post #2

LostKobrakai

You also need :fail_if_no_peer_cert set to true. It defaults to false.

Post #7

Last Post!

stephenloggedon

This was definitely my first inclination, but Bandit is rejecting this option. Those options are piped through to Bandit, correct?

** (Mix) Could not start application phx_rest: PhxRest.Application.start(:normal, []) returned an error: shutdown: failed to start child: PhxRestWeb.Endpoint
    ** (EXIT) shutdown: failed to start child: {PhxRestWeb.Endpoint, :https}
        ** (EXIT) an exception was raised:
            ** (RuntimeError) Unsupported key(s) in top level config: [:verify]
                (bandit 1.5.3) lib/bandit.ex:354: Bandit.validate_options/3
                (bandit 1.5.3) lib/bandit.ex:233: Bandit.start_link/1
                (stdlib 5.2.3) supervisor.erl:420: :supervisor.do_start_child_i/3
                (stdlib 5.2.3) supervisor.erl:406: :supervisor.do_start_child/2
                (stdlib 5.2.3) supervisor.erl:390: anonymous fn/3 in :supervisor.start_children/2
                (stdlib 5.2.3) supervisor.erl:1258: :supervisor.children_map/4
                (stdlib 5.2.3) supervisor.erl:350: :supervisor.init_children/2
                (stdlib 5.2.3) gen_server.erl:980: :gen_server.init_it/2
                (stdlib 5.2.3) gen_server.erl:935: :gen_server.init_it/6
                (stdlib 5.2.3) proc_lib.erl:241: :proc_lib.init_p_do_apply/3

However, it is working with the Cowboy adapter! Thanks for the help on this.

Post #10