# Client certificate auth blocks access for some certs

**URL:** <https://discourse.haproxy.org/t/client-certificate-auth-blocks-access-for-some-certs/5085>\
**Category:** Help!\
**Created:** [April 17, 2020, 8:58am UTC](https://discourse.haproxy.org/t/client-certificate-auth-blocks-access-for-some-certs/5085 "2020-04-17T08:58:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mirco.drick](https://avatars.discourse-cdn.com/v4/letter/m/d78d45/32.png) [@mirco.drick](https://discourse.haproxy.org/u/mirco.drick)\
**Post date:** [April 17, 2020, 8:58am UTC](https://discourse.haproxy.org/t/client-certificate-auth-blocks-access-for-some-certs/5085/1 "2020-04-17T08:58:42Z")

</div>

I’m trying to setup client based authentication and got a weird problem. When using smartcard certs I get error  
SSL client certificate not trusted  
even though I’ve set “verify optional” and “crt-ignore-err all ca-ignore-err all” in my frontend. The smartcard certificate validates fine using openssl on the client using the CA specified as CA in haproxy.conf. The must strange thing is that if I use a selfsigned certificate then it works.  
Any suggestion on what might be causing this?

Simplified config I am using:  
global  
chroot /var/lib/haproxy  
user haproxy  
group haproxy  
daemon  
crt-base /etc/haproxy/ssl  
ssl-server-verify none  
frontend main  
bind :443 ssl crt website-cert.pem ca-file client-CA-with-chain.pem verify optional crt-ignore-err all ca-ignore-err all

```
default_backend test
   cookie SRVID insert nocache
   server server1 127.0.0.1:8088 maxconn 1

```

curl using selfsigned cert against haproxy with netcat running on backend:  
curl --insecure --cert-type pem --cert test-cert.pem [https://netcat-server](https://netcat-server)  
netcat server output:  
ncat -l 127.0.0.1 8088  
GET / HTTP/1.1  
host: netcat-server  
user-agent: curl/7.66.0  
accept: _/_  
x-ssl: 1  
x-ssl-client-sha1: &y�5e��T�%0F%7F�}A�%14%1A�)�  
x-ssl-client-verify: 21  
x-ssl-client-dn: dn string  
x-ssl-issuer: issuer string  
connection: close

curl using smartcard cert against haproxy with netcat running on backend:  
curl -v --insecure -E ‘pkcs11:URL’ [https://netcat-server](https://netcat-server)  
Enter PKCS#11 token PIN for Instant EID IP9 (identification):  
\* successfully set certificate verify locations:  
\* CAfile: /etc/pki/tls/certs/ca-bundle.crt  
CApath: none  
\* TLSv1.3 (OUT), TLS handshake, Client hello (1):  
\* TLSv1.3 (IN), TLS handshake, Server hello (2):  
\* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):  
\* TLSv1.3 (IN), TLS handshake, Request CERT (13):  
\* TLSv1.3 (IN), TLS handshake, Certificate (11):  
\* TLSv1.3 (IN), TLS handshake, CERT verify (15):  
\* TLSv1.3 (IN), TLS handshake, Finished (20):  
\* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):  
\* TLSv1.3 (OUT), TLS handshake, Certificate (11):  
\* TLSv1.3 (OUT), TLS handshake, CERT verify (15):  
\* TLSv1.3 (OUT), TLS handshake, Finished (20):  
\* SSL connection using TLSv1.3 / TLS\_AES\_256\_GCM\_SHA384  
\* ALPN, server did not agree to a protocol  
\* Server certificate:  
…  
\* SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.  
\> GET / HTTP/1.1  
\> Host: helpdesk.cardservices.no  
\> User-Agent: curl/7.66.0  
\> Accept: _/_  
\>  
\* TLSv1.3 (IN), TLS alert, bad certificate (554):  
\* OpenSSL SSL\_read: error:14094412:SSL routines:ssl3\_read\_bytes:sslv3 alert bad certificate, errno 0  
\* Closing connection 0  
curl: (56) OpenSSL SSL\_read: error:14094412:SSL routines:ssl3\_read\_bytes:sslv3 alert bad certificate, errno 0

netcat gives no output and haproxy log gives error " SSL client certificate not trusted" so the connection is closed at the frontend for some reason.

---

<div class="post-metadata">

**Author:** ![mirco.drick](https://avatars.discourse-cdn.com/v4/letter/m/d78d45/32.png) [@mirco.drick](https://discourse.haproxy.org/u/mirco.drick)\
**Post date:** [April 22, 2020, 6:28am UTC](https://discourse.haproxy.org/t/client-certificate-auth-blocks-access-for-some-certs/5085/2 "2020-04-22T06:28:01Z")

</div>

anyone any suggestion on how to debug further? Also why does haproxy block access with ‘certificate not trusted’ even though I’ve set ‘verify optional’ - thats the thing that bothers me most…

---

<div class="post-metadata">

**Author:** ![Nowaker](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/nowaker/32/1270_2.png) [@Nowaker](https://discourse.haproxy.org/u/Nowaker)\
**Post date:** [October 6, 2020, 8:23pm UTC](https://discourse.haproxy.org/t/client-certificate-auth-blocks-access-for-some-certs/5085/3 "2020-10-06T20:23:20Z")

</div>

I’m affected by this too. `verify optional` + `crt-ignore-err all ca-ignore-err all` are bugged, HAProxy does not respect it in some situations. It’s a regression since HAProxy `1.5.10` works fine, while the exact same config and requests to `2.1.8-1ppa1~focal` fail.

---

<div class="post-metadata">

**Author:** ![Nowaker](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/nowaker/32/1270_2.png) [@Nowaker](https://discourse.haproxy.org/u/Nowaker)\
**Post date:** [October 6, 2020, 9:59pm UTC](https://discourse.haproxy.org/t/client-certificate-auth-blocks-access-for-some-certs/5085/4 "2020-10-06T21:59:16Z")

</div>

My team will try recreating the problem in Docker, and we’ll check against each available HAProxy to understand what version the regression was introduced.