Uploaded image for project: 'Red Hat 3scale API Management'
  1. Red Hat 3scale API Management
  2. THREESCALE-5105

Mutual TLS between APIcast and the Backend API fails when using a Forward Proxy

    XMLWordPrintable

Details

    Description

      The Red Hat 3scale Support Team has been able to reproduce the issue.

      Please find more information in the "Steps to Reproduce". It's possible to isolate the issue as being related to APIcast because the equivalent from 'curl' works:

      1. Without using a Proxy:

      $ env | grep -i "proxy"
      <EMPTY>
      $ curl https://server.cryptomix.com/secure/ --cert APIcast-client.crt --key APIcast-client.key 2>&1 | grep -i "</head>" -A 1
      </head>
      <br><span class="sslsuccess">SSL Authentication OK!</span><br><br>Technical information follows :<pre>Array
      

      2. Using a Proxy:

      $ export http_proxy="http://<PROXY>:<PORT>"
      $ export https_proxy="http://<PROXY>:<PORT>"
      $ curl https://server.cryptomix.com/secure/ --cert APIcast-client.crt --key APIcast-client.key 2>&1 | grep -i "</head>" -A 1
      </head>
      <br><span class="sslsuccess">SSL Authentication OK!</span><br><br>Technical information follows :<pre>Array
      

      I have tested all versions from APIcast starting from 2.6 and was able to reproduce the issue. It's very likely that it affects previous versions as well.

      Hence, APIcast should be able to send the client certificates from 'APICAST_PROXY_HTTPS_CERTIFICATE' and 'APICAST_PROXY_HTTPS_CERTIFICATE_KEY' to the Backend API regardless of whether a Forward Proxy is being used.


      Please find attached the APIcast 2.8 logs from both a success (without using a Forward Proxy) and failure (using a Forward Proxy), respectively.

      Attachments

        Issue Links

          Activity

            People

              Unassigned Unassigned
              rhn-support-ekonecsn Estevao Konecsni
              Votes:
              3 Vote for this issue
              Watchers:
              9 Start watching this issue

              Dates

                Created:
                Updated: