]> Ping Identity

bcampbell@pingidentity.com

Akamai

mbishop@evequefou.be

Applications and Real-Time HTTP http client certificate This document describes HTTP extension header fields that allow a TLS terminating reverse proxy to convey the client certificate information of a mutually-authenticated TLS connection to the origin server in a common and predictable manner. About This Document Status information for this document may be found at . Discussion of this document takes place on the HTTP Working Group mailing list (), which is archived at . Working Group information can be found at . Source for this draft and an issue tracker can be found at .

Introduction A fairly common deployment pattern for HTTPS applications is to have the origin HTTP application servers sit behind a reverse proxy that terminates TLS connections from clients. The proxy is accessible to the internet and dispatches client requests to the appropriate origin server within a private or protected network. The origin servers are not directly accessible by clients and are only reachable through the reverse proxy. The backend details of this type of deployment are typically opaque to clients who make requests to the proxy server and see responses as though they originated from the proxy server itself. Although HTTPS is also usually employed between the proxy and the origin server, the TLS connection that the client establishes for HTTPS is only between itself and the reverse proxy server. The deployment pattern is found in a number of varieties such as n-tier architectures, content delivery networks, application load balancing services, and ingress controllers. Although not exceedingly prevalent, TLS client certificate authentication is sometimes employed and in such cases the origin server often requires information about the client certificate for its application logic. Such logic might include access control decisions, audit logging, and binding issued tokens or cookies to a certificate, and the respective validation of such bindings. The specific details from the certificate needed also vary with the application requirements. In order for these types of application deployments to work in practice, the reverse proxy needs to convey information about the client certificate to the origin application server. At the time of writing, a common way this information is conveyed is by using non-standard fields to carry the certificate (in some encoding) or individual parts thereof in the HTTP request that is dispatched to the origin server. This solution works but interoperability between independently developed components can be cumbersome or even impossible depending on the implementation choices respectively made (like what field names are used or are configurable, which parts of the certificate are exposed, or how the certificate is encoded). A well-known predictable approach to this commonly occurring functionality could improve and simplify interoperability between independent implementations. This document describes two HTTP header fields, Client-Cert and Client-Cert-Chain, which a TLS terminating reverse proxy (TTRP) adds to requests sent to the backend origin servers. The Client-Cert field value contains the end-entity client certificate from the mutually-authenticated TLS connection between the originating client and the TTRP. Optionally, the Client-Cert-Chain field value contains the certificate chain used for validation of the end-entity certificate. This enables the backend origin server to utilize the client certificate information in its application logic. While there may be additional proxies or hops between the TTRP and the origin server (potentially even with mutually-authenticated TLS connections between them), the scope of the Client-Cert header field is intentionally limited to exposing to the origin server the certificate that was presented by the originating client in its connection to the TTRP.

Requirements Notation and Conventions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Terminology and Applicability This document uses the following terminology from to specify syntax and parsing: List and Byte Sequence. Phrases like TLS client certificate authentication or mutually-authenticated TLS are used throughout this document to refer to the process whereby, in addition to the normal TLS server authentication with a certificate, a client presents its X.509 certificate and proves possession of the corresponding private key to a server when negotiating a TLS connection or the resumption of such a connection. In contemporary versions of TLS this requires that the client send the Certificate and CertificateVerify messages during the handshake and for the server to verify the CertificateVerify and Finished messages. HTTP/2 restricts TLS 1.2 renegotiation () and prohibits TLS 1.3 post-handshake authentication . However, they are sometimes used to implement reactive client certificate authentication in HTTP/1.1 where the server decides whether to request a client certificate based on the HTTP request. HTTP application data sent on such a connection after receipt and verification of the client certificate is also mutually-authenticated and thus suitable for the mechanisms described in this document. With post-handshake authentication there is also the possibility, though unlikely in practice, of multiple certificates and certificate chains from the client on a connection, in which case only the certificate and chain of the last post-handshake authentication are to be utilized for the header fields described herein.

HTTP Header Fields and Processing Rules This document designates the following headers, defined further in and respectively, to carry the client certificate information of a mutually-authenticated TLS connection. The headers convey the information from the reverse proxy to the origin server.

Client-Cert:

The end-entity certificate used by the client in the TLS handshake with the reverse proxy.

Client-Cert-Chain:

The certificate chain used for validation of the end-entity certificate provided by the client in the TLS handshake with the reverse proxy.

Encoding The headers in this document encode certificates as Byte Sequences () where the value of the binary data is a DER encoded X.509 certificate . In effect, this means that the binary DER certificate is encoded using base64 (without line breaks, spaces, or other characters outside the base64 alphabet) and delimited with colons on either side. Note that certificates are often stored encoded in a textual format, such as the one described in , which is already nearly compatible with a Byte Sequence; if so, it will be sufficient to replace ---(BEGIN|END) CERTIFICATE--- with : and remove line breaks in order to generate an appropriate item.

Client-Cert HTTP Header Field In the context of a TLS terminating reverse proxy deployment, the proxy makes the TLS client certificate available to the backend application with the Client-Cert HTTP header field. This field contains the end-entity certificate used by the client in the TLS handshake. Client-Cert is a Byte Sequence with the value of the header encoded as described in . The Client-Cert header field is only for use in HTTP requests and MUST NOT be used in HTTP responses. It is a singleton header field value as defined in , which MUST NOT have a list of values or occur multiple times in a request. in has an example of the Client-Cert header field.

Client-Cert-Chain HTTP Header Field In the context of a TLS terminating reverse proxy deployment, the proxy MAY make the certificate chain available to the backend application with the Client-Cert-Chain HTTP header field. Client-Cert-Chain is a List (). Each item in the list MUST be a Byte Sequence encoded as described in . The order is the same as the ordering in TLS (such as described in ). The Client-Cert-Chain header field is only for use in HTTP requests and MUST NOT be used in HTTP responses. It MAY have a list of values or occur multiple times in a request. For header compression purposes, it might be advantageous to split lists into multiple instances. in has an example of the Client-Cert-Chain header field.

Processing Rules This section outlines the applicable processing rules for a TLS terminating reverse proxy (TTRP) that has negotiated a mutually-authenticated TLS connection to convey the client certificate from that connection to the backend origin servers. Use of the technique is to be a configuration or deployment option and the processing rules described herein are for servers operating with that option enabled. A TTRP negotiates the use of a mutually-authenticated TLS connection with the client, such as is described in or , and validates the client certificate per its policy and trusted certificate authorities. Each HTTP request on the underlying TLS connection are dispatched to the origin server with the following modifications:

1. The client certificate is placed in the Client-Cert header field of the dispatched request, as described in .
2. If so configured, the validation chain of the client certificate is placed in the Client-Cert-Chain header field of the request, as described in .
3. Any occurrence of the Client-Cert or Client-Cert-Chain header fields in the original incoming request MUST be removed or overwritten before forwarding the request. An incoming request that has a Client-Cert or Client-Cert-Chain header field MAY be rejected with an HTTP 400 response.

Requests made over a TLS connection where the use of client certificate authentication was not negotiated MUST be sanitized by removing any and all occurrences of the Client-Cert and Client-Cert-Chain header fields prior to dispatching the request to the backend server. Backend origin servers may then use the Client-Cert header field of the request to determine if the connection from the client to the TTRP was mutually-authenticated and, if so, the certificate thereby presented by the client. Access control decisions based on the client certificate (or lack thereof) can be conveyed by selecting response content as appropriate or with an HTTP 403 response, if the certificate is deemed unacceptable for the given context. Note that TLS clients that rely on error indications at the TLS layer for an unacceptable certificate will not receive those signals. When the value of the Client-Cert request header field is used to select a response (e.g., the response content is access-controlled), the response MUST either be uncacheable (e.g., by sending Cache-Control: no-store) or be designated for selective reuse only for subsequent requests with the same Client-Cert header value by sending a Vary: Client-Cert response header. If a TTRP encounters a response with a client-cert field name in the Vary header field, it SHOULD prevent the user agent from caching the response by transforming the value of the Vary response header field to *. Forward proxies and other intermediaries MUST NOT add the Client-Cert or Client-Cert-Chain header fields to requests, or modify an existing Client-Cert or Client-Cert-Chain header field. Similarly, clients MUST NOT employ the Client-Cert or Client-Cert-Chain header field in requests.

Deployment Considerations

Header Field Compression If the connection between the TTRP and origin is capable of field compression (e.g., HPACK or QPACK ), and the TTRP multiplexes more than one client's requests into that connection, the size and variation of Client-Cert and Client-Cert-Chain field values can reduce compression efficiency significantly. An origin could mitigate the efficiency loss by increasing the size of the dynamic table. If the TTRP determines that the origin dynamic table is not sufficiently large, it may find it beneficial to always send the field value as a literal, rather than entering it into the table.

Message Header Size A server in receipt of a larger message header than it is willing to handle can send an HTTP 431 (Request Header Fields Too Large) status code per . Due to the typical size of the field values containing certificate data, recipients may need to be configured to allow for a larger maximum header size. An intermediary generating client certificate header fields on connections that allow for advertising the maximum acceptable header size (e.g. HTTP/2 or HTTP/3 ) should account for the additional size of the header of the requests it sends vs. requests it receives by advertising a value to its clients that is sufficiently smaller so as to allow for the addition of certificate data.

TLS Session Resumption Some TLS implementations do not retain client certificate information when resuming. Providing inconsistent values of Client-Cert and Client-Cert-Chain when resuming might lead to errors, so implementations that are unable to provide these values SHOULD either disable resumption for connections with client certificates or initially omit a Client-Cert or Client-Cert-Chain field if it might not be available after resuming.

Security Considerations The header fields described herein enable a TTRP and backend or origin server to function together as though, from the client's perspective, they are a single logical server side deployment of HTTPS over a mutually-authenticated TLS connection. Use of the header fields outside that intended use case, however, may undermine the protections afforded by TLS client certificate authentication. Therefore, steps MUST be taken to prevent unintended use, both in sending the header field and in relying on its value. Producing and consuming the Client-Cert and Client-Cert-Chain header fields SHOULD be configurable options, respectively, in a TTRP and backend server (or individual application in that server). The default configuration for both should be to not use the header fields thus requiring an "opt-in" to the functionality. In order to prevent field injection, backend servers MUST only accept the Client-Cert and Client-Cert-Chain header fields from a trusted TTRP (or other proxy in a trusted path from the TTRP). A TTRP MUST sanitize the incoming request before forwarding it on by removing or overwriting any existing instances of the fields. Otherwise, arbitrary clients can control the field values as seen and used by the backend server. It is important to note that neglecting to prevent field injection does not "fail safe" in that the nominal functionality will still work as expected even when malicious actions are possible. As such, extra care is recommended in ensuring that proper field sanitation is in place. The communication between a TTRP and backend server needs to be secured against eavesdropping and modification by unintended parties. The configuration options and request sanitization are necessarily functionally of the respective servers. The other requirements can be met in a number of ways, which will vary based on specific deployments. The communication between a TTRP and backend or origin server, for example, might be authenticated in some way with the insertion and consumption of the Client-Cert and Client-Cert-Chain header fields occurring only on that connection. gives one example of this with an application of HTTP Message Signatures. Alternatively the network topology might dictate a private network such that the backend application is only able to accept requests from the TTRP and the proxy can only make requests to that server. Other deployments that meet the requirements set forth herein are also possible.

IANA Considerations

HTTP Field Name Registrations Please register the following entries in the "Hypertext Transfer Protocol (HTTP) Field Name Registry" defined by HTTP Semantics :

• Field name: Client-Cert
• Status: permanent
• Specification document: of [this document]
  
• Field name: Client-Cert-Chain
• Status: permanent
• Specification document: of [this document]

References Normative References This document describes a set of data types and associated algorithms that are intended to make it easier and safer to define and handle HTTP header and trailer fields, known as "Structured Fields", "Structured Headers", or "Structured Trailers". It is intended for use by specifications of new HTTP fields that wish to use a common syntax that is more restrictive than traditional HTTP field values. The Hypertext Transfer Protocol (HTTP) is a stateless application-level protocol for distributed, collaborative, hypertext information systems. This document describes the overall architecture of HTTP, establishes common terminology, and defines aspects of the protocol that are shared by all versions. In this definition are core protocol elements, extensibility mechanisms, and the "http" and "https" Uniform Resource Identifier (URI) schemes. This document updates RFC 3864 and obsoletes RFCs 2818, 7231, 7232, 7233, 7235, 7538, 7615, 7694, and portions of 7230. In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. This memo profiles the X.509 v3 certificate and X.509 v2 certificate revocation list (CRL) for use in the Internet. An overview of this approach and model is provided as an introduction. The X.509 v3 certificate format is described in detail, with additional information regarding the format and semantics of Internet name forms. Standard certificate extensions are described and two Internet-specific extensions are defined. A set of required certificate extensions is specified. The X.509 v2 CRL format is described in detail along with standard and Internet-specific extensions. An algorithm for X.509 certification path validation is described. An ASN.1 module and examples are provided in the appendices. [STANDARDS-TRACK] International Telecommunications Union Informative References The Hypertext Transfer Protocol (HTTP) is a stateless application-level protocol for distributed, collaborative, hypertext information systems. This document specifies the HTTP/1.1 message syntax, message parsing, connection management, and related security concerns. This document obsoletes portions of RFC 7230. This specification describes an optimized expression of the semantics of the Hypertext Transfer Protocol (HTTP), referred to as HTTP version 2 (HTTP/2). HTTP/2 enables a more efficient use of network resources and a reduced latency by introducing field compression and allowing multiple concurrent exchanges on the same connection. This document obsoletes RFCs 7540 and 8740. The QUIC transport protocol has several features that are desirable in a transport for HTTP, such as stream multiplexing, per-stream flow control, and low-latency connection establishment. This document describes a mapping of HTTP semantics over QUIC. This document also identifies HTTP/2 features that are subsumed by QUIC and describes how HTTP/2 extensions can be ported to HTTP/3. Amazon Bespoke Engineering Digital Bazaar This document describes a mechanism for creating, encoding, and verifying digital signatures or message authentication codes over components of an HTTP message. This mechanism supports use cases where the full HTTP message may not be known to the signer, and where the message may be transformed (e.g., by intermediaries) before reaching the verifier. This document also describes a means for requesting that a signature be applied to a subsequent HTTP message in an ongoing HTTP exchange. This document specifies version 1.3 of the Transport Layer Security (TLS) protocol. TLS allows client/server applications to communicate over the Internet in a way that is designed to prevent eavesdropping, tampering, and message forgery. This document updates RFCs 5705 and 6066, and obsoletes RFCs 5077, 5246, and 6961. This document also specifies new requirements for TLS 1.2 implementations. This document specifies Version 1.2 of the Transport Layer Security (TLS) protocol. The TLS protocol provides communications security over the Internet. The protocol allows client/server applications to communicate in a way that is designed to prevent eavesdropping, tampering, or message forgery. [STANDARDS-TRACK] This document updates RFC 7540 by forbidding TLS 1.3 post-handshake authentication, as an analog to the existing TLS 1.2 renegotiation restriction. This document describes and discusses the textual encodings of the Public-Key Infrastructure X.509 (PKIX), Public-Key Cryptography Standards (PKCS), and Cryptographic Message Syntax (CMS). The textual encodings are well-known, are implemented by several applications and libraries, and are widely deployed. This document articulates the de facto rules by which existing implementations operate and defines them so that future implementations can interoperate. This document specifies Version 1.2 of the Transport Layer Security (TLS) protocol. The TLS protocol provides communications security over the Internet. The protocol allows client/server applications to communicate in a way that is designed to prevent eavesdropping, tampering, or message forgery. [STANDARDS-TRACK] This specification defines HPACK, a compression format for efficiently representing HTTP header fields, to be used in HTTP/2. This specification defines QPACK: a compression format for efficiently representing HTTP fields that is to be used in HTTP/3. This is a variation of HPACK compression that seeks to reduce head-of-line blocking. This document specifies additional HyperText Transfer Protocol (HTTP) status codes for a variety of common situations. [STANDARDS-TRACK] This document defines an HTTP extension header field that allows proxy components to disclose information lost in the proxying process, for example, the originating IP address of a request or IP address of the proxy on the user-agent-facing interface. In a path of proxying components, this makes it possible to arrange it so that each subsequent component will have access to, for example, all IP addresses used in the chain of proxied HTTP requests. This document also specifies guidelines for a proxy administrator to anonymize the origin of a request. This document describes OAuth client authentication and certificate-bound access and refresh tokens using mutual Transport Layer Security (TLS) authentication with X.509 certificates. OAuth clients are provided a mechanism for authentication to the authorization server using mutual TLS, based on either self-signed certificates or public key infrastructure (PKI). OAuth authorization servers are provided a mechanism for binding access tokens to a client's mutual-TLS certificate, and OAuth protected resources are provided a method for ensuring that such an access token presented to it was issued to the client presenting the token.

Example In a hypothetical example where a TLS client presents the client and intermediate certificate from when establishing a mutually-authenticated TLS connection with the TTRP, the proxy would send the Client-Cert field shown in to the backend. Note that line breaks and whitespace have been added to the field value in and for display and formatting purposes only.

Certificate Chain (with client certificate first)

Header Field in HTTP Request to Origin Server

If the proxy were configured to also include the certificate chain, it would also include this header:

Certificate Chain in HTTP Request to Origin Server

Considerations Considered

Field Injection This draft requires that the TTRP sanitize the fields of the incoming request by removing or overwriting any existing instances of the Client-Cert and Client-Cert-Chain header fields before dispatching that request to the backend application. Otherwise, a client could inject its own values that would appear to the backend to have come from the TTRP. Although numerous other methods of detecting/preventing field injection are possible; such as the use of a unique secret value as part of the field name or value or the application of a signature, HMAC, or AEAD, there is no common general mechanism. The potential problem of client field injection is not at all unique to the functionality of this draft, and it would therefore be inappropriate for this draft to define a one-off solution. In the absence of a generic common solution existing currently, stripping/sanitizing the fields is the de facto means of protecting against field injection in practice. Sanitizing the fields is sufficient when properly implemented and is a normative requirement of .

The Forwarded HTTP Extension The Forwarded HTTP header field defined in allows proxy components to disclose information lost in the proxying process. The TLS client certificate information of concern to this draft could have been communicated with an extension parameter to the Forwarded field; however, doing so would have had some disadvantages that this draft endeavored to avoid. The Forwarded field syntax allows for information about a full chain of proxied HTTP requests, whereas the Client-Cert and Client-Cert-Chain header fields of this document are concerned only with conveying information about the certificate presented by the originating client on the TLS connection to the TTRP (which appears as the server from that client's perspective) to backend applications. The multi-hop syntax of the Forwarded field is expressive but also more complicated, which would make processing it more cumbersome, and more importantly, make properly sanitizing its content as required by to prevent field injection considerably more difficult and error-prone. Thus, this draft opted for a flatter and more straightforward structure.

The Whole Certificate and Certificate Chain Different applications will have varying requirements about what information from the client certificate is needed, such as the subject and/or issuer distinguished name, subject alternative name(s), serial number, subject public key info, fingerprint, etc.. Furthermore, some applications, such as , make use of the entire certificate. In order to accommodate the latter and ensure wide applicability by not trying to cherry-pick particular certificate information, this draft opted to pass the full encoded certificate as the value of the Client-Cert field. The validation of the client certificate and chain of the mutually-authenticated TLS connection is typically performed by the TTRP during the handshake. With the responsibility of certificate validation falling on the TTRP, the end-entity certificate is oftentimes sufficient for the needs of the origin server. The separate Client-Cert-Chain field can convey the certificate chain for origin server deployments that require this additional information.

Acknowledgements The authors would like to thank the following individuals who've contributed in various ways ranging from just being generally supportive of bringing forth the draft to providing specific feedback or content:

• Evan Anderson
• Annabelle Backman
• Alan Frindell
• Rory Hewitt
• Fredrik Jeansson
• Benjamin Kaduk
• Torsten Lodderstedt
• Kathleen Moriarty
• Mark Nottingham
• Erik Nygren
• Mike Ounsworth
• Lucas Pardue
• Matt Peterson
• Eric Rescorla
• Justin Richer
• Michael Richardson
• Joe Salowey
• Rich Salz
• Mohit Sethi
• Rifaat Shekh-Yusef
• Travis Spencer
• Nick Sullivan
• Willy Tarreau
• Martin Thomson
• Peter Wu
• Hans Zandbelt

Document History

• To be removed by the RFC Editor before publication as an RFC

draft-ietf-httpbis-client-cert-field-04

• Updates, fixes, and clarifications from WGLC feedback

draft-ietf-httpbis-client-cert-field-03

• State that the certificate chain is in the same order as it appears in TLS rather than copying the language from TLS
• Update references for HTTP Semantics, HTTP/3, and QPACK to point to the now RFCs 9110/9114/9204
• HTTP Semantics now a normative ref
• Mention that origin server access control decisions can be conveyed by selecting response content or with a 403

draft-ietf-httpbis-client-cert-field-02

• Add a note about cert retention on TLS session resumption
• Say to use only the last one in the case of multiple post-handshake client cert authentications

draft-ietf-httpbis-client-cert-field-01

• Use RFC 8941 Structured Field Values for HTTP
• Introduce a separate header that can convey the certificate chain
• Add considerations on header compression and size
• Describe interaction with caching
• Fill out IANA Considerations with HTTP field name registrations
• Discuss renegotiation

draft-ietf-httpbis-client-cert-field-00

• Initial WG revision
• Mike Bishop added as co-editor

draft-bdc-something-something-certificate-05

• Change intended status of the draft to Informational
• Editorial updates and (hopefully) clarifications

draft-bdc-something-something-certificate-04

• Update reference from draft-ietf-oauth-mtls to RFC8705

draft-bdc-something-something-certificate-03

• Expanded further discussion notes to capture some of the feedback in and around the presentation of the draft in SECDISPATCH at IETF 107 and add those who've provided such feedback to the acknowledgements

draft-bdc-something-something-certificate-02

• Editorial tweaks + further discussion notes

draft-bdc-something-something-certificate-01

• Use the RFC v3 Format or die trying

draft-bdc-something-something-certificate-00

• Initial draft after a time constrained and rushed secdispatch presentation at IETF 106 in Singapore with the recommendation to write up a draft (at the end of the minutes) and some folks expressing interest despite the rather poor presentation