Skip to content

Feature Request : Add TLS auth support #51

@toxic0berliner

Description

@toxic0berliner

Hello,

I wish to be able to pass a user certificate as well as the intermediate (and CA certificates ?) for this bouncer to be able to login to the LAPI using the provided user certificate.
This way it allows to auto-&acceptregister the bouncer instead of having to generate an api key or approve the bouncer.

new environment variables could be

  • CROWDSEC_BOUNCER_CERT_FILE path to the client cert file inside the container (mounted with volume or other secrets mechanisms)
  • CROWDSEC_BOUNCER_KEY_FILE path to the client cert key file inside the container (mounted with volume or other secrets mechanisms)
  • CROWDSEC_CACERT_FILE path to the trust authority signing the server certificate.

I'm not entirely sure why/how but I was expecting the above proposed CROWDSEC_CACERT_FILE to already be mandatory to use https for the LAPI when using a custom CA, but somehow this bouncer seems to accept my self-signed CA even though I did not do anything to tell him about my CA... I believe this means somewhere there is something trusting any provided certificate, probably not the best...

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions