In 2021 can the AWS Loadbalancers (ELB) forward the client certificate in a HTTP Header?
Currently the ELB load balancer is configured as a classic application load balancer,
forwarding both HTTP and HTTPS to the endpoint. I could alter this and use TCP,
but then I would loose the certificate management functionality provided by the AWS
Certificate Manager, auto renewing certificates.
Here is an example of ASP.NET Core endpoint, extracting the certificate from an HTTP Header variable: X-SSL-CERT
public void ConfigureServices(IServiceCollection services)
{
services.AddCertificateForwarding(options =>
{
options.CertificateHeader = "X-SSL-CERT";
options.HeaderConverter = (headerValue) =>
{
X509Certificate2 clientCertificate = null;
if(!string.IsNullOrWhiteSpace(headerValue))
{
byte[] bytes = StringToByteArray(headerValue);
clientCertificate = new X509Certificate2(bytes);
}
return clientCertificate;
};
});
}
My goal is to use AWS Managed Certificate's (Web Trusted) for authenticating the server, and self signed client certificates for authenticating the clients. I am not sure if this is possible yet, to have two different CA's (one CA not being public) when doing Mutual TLS.