# Check Certificate in Backend possible

**URL:** <https://discourse.haproxy.org/t/check-certificate-in-backend-possible/1358>\
**Category:** Help!\
**Created:** [June 21, 2017, 11:23am UTC](https://discourse.haproxy.org/t/check-certificate-in-backend-possible/1358 "2017-06-21T11:23:35Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![silviu](https://avatars.discourse-cdn.com/v4/letter/s/b5a626/32.png) [@silviu](https://discourse.haproxy.org/u/silviu)\
**Post date:** [June 21, 2017, 11:23am UTC](https://discourse.haproxy.org/t/check-certificate-in-backend-possible/1358/1 "2017-06-21T11:23:35Z")

</div>

Hi everyone,

As i already mentioned in another post, I am using just one front end and more backends.  
as for one specific location is a certificate check necessary, i would like to check in that specific backend and for the specific site.  
the apache for this section shows like this :

> Location /api  
> Allow from all  
> Satisfy any  
> SSLRequireSSL  
> SSLVerifyClient require  
> SSLVerifyDepth 2  
> SSLRequire ( %{SSL\_CLIENT\_S\_DN\_O} eq “Company name”   
> and %{SSL\_CLIENT\_S\_DN\_OU} eq “department”   
> and %{SSL\_CLIENT\_S\_DN\_C} eq “US”   
> and %{SSL\_CLIENT\_S\_DN\_CN} in { “User\_1”, “host01” }   
> )  
> ProxyPass 1.1.1.1:8090/api nocanon  
> ProxyPassReverse 1.1.1.1:8090/api  
> /Location

Any ideea how I can rewrite from apache to haproxy ?

Thanks and cheers,

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [June 21, 2017, 12:12pm UTC](https://discourse.haproxy.org/t/check-certificate-in-backend-possible/1358/2 "2017-06-21T12:12:44Z")

</div>

If I understand correctly you are talking about client certificate verification, and you would like to do that in one specific URI.

That’s not possible with haproxy.

---

<div class="post-metadata">

**Author:** ![silviu](https://avatars.discourse-cdn.com/v4/letter/s/b5a626/32.png) [@silviu](https://discourse.haproxy.org/u/silviu)\
**Post date:** [June 21, 2017, 12:20pm UTC](https://discourse.haproxy.org/t/check-certificate-in-backend-possible/1358/3 "2017-06-21T12:20:36Z")

</div>

Yes @lukastribus, i’m talking about client certificate verification and yes i would like to do it for [www.example.com/api](http://www.example.com/api) but [www.example.com](http://www.example.com) should be available to all.

Thanks,

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [June 21, 2017, 2:05pm UTC](https://discourse.haproxy.org/t/check-certificate-in-backend-possible/1358/4 "2017-06-21T14:05:36Z")

</div>

Like I said this is not possible with Haproxy. Apache is pretty much the only product that can do this.

The recommended way is to use a different (SNI-) hostname and certificate for this, and negotiate client certificates in the beginning.

---

<div class="post-metadata">

**Author:** ![silviu](https://avatars.discourse-cdn.com/v4/letter/s/b5a626/32.png) [@silviu](https://discourse.haproxy.org/u/silviu)\
**Post date:** [June 22, 2017, 7:22am UTC](https://discourse.haproxy.org/t/check-certificate-in-backend-possible/1358/5 "2017-06-22T07:22:24Z")

</div>

Thank you very much for your help.

Cheers,  
silviu