# Haproxy with Nginx can't use client certificate authentication

**URL:** <https://discourse.haproxy.org/t/haproxy-with-nginx-cant-use-client-certificate-authentication/3617>\
**Category:** Help!\
**Created:** [March 14, 2019, 11:30am UTC](https://discourse.haproxy.org/t/haproxy-with-nginx-cant-use-client-certificate-authentication/3617 "2019-03-14T11:30:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mario](https://avatars.discourse-cdn.com/v4/letter/m/8e7dd6/32.png) [@Mario](https://discourse.haproxy.org/u/Mario)\
**Post date:** [March 14, 2019, 11:30am UTC](https://discourse.haproxy.org/t/haproxy-with-nginx-cant-use-client-certificate-authentication/3617/1 "2019-03-14T11:30:00Z")

</div>

Hi, all

I have one IP Adress and one port 443  
At the end I have four web applications  
I use two domain name ([www.domainsample1.com](http://www.domainsample1.com), [www.domainsample2.com](http://www.domainsample2.com)) and two context root (context\_root\_1, context\_root\_2) to backend mapping  
I have path: request https -\> nginx -\> haproxy -\> http application  
It works until I try to use client certificate authentication  
When I add client certificate authentication I get error “1: SSL handshake failure” and client browser do not even try to ask questions about the use of the certificate.  
When I test it without nginx (https -\> haproxy -\> http application ) I can authenticate with a client certificate but I get a 400 error when displaying the application page.  
Any help or suggestions are appreciated.  
Thanks! 🙂

config haproxy:

global  
# log 127.0.0.1 local1 notice  
log localhost:514 local0  
stats timeout 30s  
user haproxy  
group haproxy  
daemon  
tune.ssl.default-dh-param 2048  
stats socket /var/run/haproxy.sock mode 666 level admin  
stats timeout 2m  
stats bind-process 1  
nbproc 2  
cpu-map 1 0  
cpu-map 2 1

defaults  
log global  
option dontlognull  
option httplog  
balance leastconn  
timeout client 60000  
timeout server 60000  
timeout connect 5000  
retries 3  
option redispatch

frontend demo  
mode http  
acl context\_root\_1 path\_beg /context\_root\_1  
acl context\_root\_2 path\_beg /context\_root\_2  
acl domainsample1 hdr(Host) [www.domainsample1.com](http://www.domainsample1.com)  
acl domainsample2 hdr(Host) [wwww.domainsample2.com](http://wwww.domainsample2.com)  
bind 172.16.10.1:443 ssl crt /etc/pki/tls/certs/domainsample1.pem crt /etc/pki/tls/certs/domainsample2.pem ca-file /etc/pki/tls/certs/CA.cer verify required  
http-request set-header X-SSL %[ssl\_fc]  
http-request set-header X-SSL-Client-Cert %[ssl\_fc\_has\_crt]  
http-request set-header X-SSL-Client-Verify %[ssl\_c\_verify]  
http-request set-header X-SSL-Client-SHA1 %{+Q}[ssl\_c\_sha1]  
http-request set-header X-SSL-Client-DN %{+Q}[ssl\_c\_s\_dn]  
http-request set-header X-SSL-Client-CN %{+Q}[ssl\_c\_s\_dn(cn)]  
http-request set-header X-SSL-Issuer %{+Q}[ssl\_c\_i\_dn]  
http-request set-header X-SSL-Client-Not-Before %{+Q}[ssl\_c\_notbefore]  
http-request set-header X-SSL-Client-Not-After %{+Q}[ssl\_c\_notafter]  
use\_backend bk\_context\_root\_1\_demo\_domainsample1 if domainsample1 context\_root\_1  
use\_backend bk\_context\_root\_1\_demo\_domainsample2 if domainsample2 context\_root\_1  
use\_backend bk\_context\_root\_2\_demo\_domainsample1 if domainsample1 context\_root\_2  
use\_backend bk\_context\_root\_2\_demo\_domainsample2 if domainsample2 context\_root\_2

backend bk\_context\_root\_1\_demo\_domainsample1  
mode http  
server server1 172.16.10.2:5071 check  
reqirep ^([^\ :]_)\ /context\_root\_1/(._) \1\ /\2

backend bk\_context\_root\_1\_demo\_domainsample2  
mode http  
server server2 172.16.10.3:5071 check  
reqirep ^([^\ :]_)\ /context\_root\_1/(._) \1\ /\2

backend bk\_context\_root\_2\_demo\_domainsample1  
mode http  
server server1 172.16.10.2:5070 check  
reqirep ^([^\ :]_)\ /context\_root\_2/(._) \1\ /\2

backend bk\_context\_root\_2\_demo\_domainsample2  
mode http  
server server2 172.16.10.3:5070 check  
reqirep ^([^\ :]_)\ /context\_root\_2/(._) \1\ /\2

haproxy -vv

HA-Proxy version 1.5.18 2016/05/10  
Copyright 2000-2016 Willy Tarreau [willy@haproxy.org](mailto:willy@haproxy.org)

Build options :  
TARGET = linux2628  
CPU = generic  
CC = gcc  
CFLAGS = -O2 -g -fno-strict-aliasing -DTCP\_USER\_TIMEOUT=18  
OPTIONS = USE\_LINUX\_TPROXY=1 USE\_ZLIB=1 USE\_REGPARM=1 USE\_OPENSSL=1 USE\_PCRE=1

Default settings :  
maxconn = 2000, bufsize = 16384, maxrewrite = 8192, maxpollevents = 200

Encrypted password support via crypt(3): yes  
Built with zlib version : 1.2.7  
Compression algorithms supported : identity, deflate, gzip  
Built with OpenSSL version : OpenSSL 1.0.2k-fips 26 Jan 2017  
Running on OpenSSL version : OpenSSL 1.0.2k-fips 26 Jan 2017  
OpenSSL library supports TLS extensions : yes  
OpenSSL library supports SNI : yes  
OpenSSL library supports prefer-server-ciphers : yes  
Built with PCRE version : 8.32 2012-11-30  
PCRE library supports JIT : no (USE\_PCRE\_JIT not set)  
Built with transparent proxy support using: IP\_TRANSPARENT IPV6\_TRANSPARENT IP\_FREEBIND

Available polling systems :  
epoll : pref=300, test result OK  
poll : pref=200, test result OK  
select : pref=150, test result OK  
Total: 3 (3 usable), will use epoll.

---

<div class="post-metadata">

**Author:** ![Mario](https://avatars.discourse-cdn.com/v4/letter/m/8e7dd6/32.png) [@Mario](https://discourse.haproxy.org/u/Mario)\
**Post date:** [March 14, 2019, 5:32pm UTC](https://discourse.haproxy.org/t/haproxy-with-nginx-cant-use-client-certificate-authentication/3617/2 "2019-03-14T17:32:41Z")

</div>

On nginx I getting error:  
2019/03/14 17:39:39 [error] 1090#0: \*6254 SSL\_do\_handshake() failed (SSL: error:14094410:SSL routines:SSL3\_READ\_BYTES:sslv3  
alert handshake failure:SSL alert number 40) while SSL handshaking to upstream,

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [April 15, 2019, 6:31pm UTC](https://discourse.haproxy.org/t/haproxy-with-nginx-cant-use-client-certificate-authentication/3617/3 "2019-04-15T18:31:21Z")

</div>

So what are you trying to solve? The 400 error without nginx or the SSL issue with nginx? How is nginx configured exactly and where those SSL termination/authentication occur exactly?