Java + Cloudflare + Mutual authentication

Question

I am trying to do a mutual authentication … My current problem is that is not working using the domain … looks like cloud flare is not forwarding my cert.

basically if I am going direct to IP works fine:

$ curl -k -E clientkey.pem https://18.228.142.39:8443/logged_info 

(this works fine)

$ curl -E clientkey.pem https://xxx.mysite.com:8443/logged_info 

(I got 525: SSL handshake failed)

I have enabled the ssl debugger and the certificates never reach the service.

some ssl log when I invoke the domain:

upcoming handshake states: server finished[20]
*** Certificate chain
https-jsse-nio-8443-exec-2, fatal error: 42: null cert chain
javax.net.ssl.SSLHandshakeException: null cert chain
%% Invalidated: [Session-1, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256]
https-jsse-nio-8443-exec-2, SEND TLSv1.2 ALERT: fatal, description = bad_certificate
https-jsse-nio-8443-exec-2, WRITE: TLSv1.2 Alert, length = 2
https-jsse-nio-8443-exec-2, fatal: engine already closed. Rethrowing javax.net.ssl.SSLHandshakeException: null cert chain
https-jsse-nio-8443-exec-2, called closeOutbound()
https-jsse-nio-8443-exec-2, closeOutboundInternal()

Is maybe something missing to enable ?

Answer 1

I think that cloudflare is terminating the TLS connection and then initiating a new connection to your origin so it can't (as far as I know) just proxy the certificate through as it never got sight of the private key on the client. It appears based on this and this that you can provide your root CA to cloudflare if you're an enterprise customer and they will validate the client identify for you, against that CA. The first article also suggests you can turn on "Authenticated Origin Pulls" which will ensure only cloudflare can talk directly to your origin servers.

The second link also says:

For companies that use the client certificate for identification, Cloudflare can also forward any field of the client certificate as a custom header.

This indicates that you can forward a field from the key to your origin in order that your origin can know who the request came from.