How to auth with client certificates and not depending on URI

[AaronWest]

@lukastribus showed an excellent example of how to do this here with seperate domains/subdomains:

How to set ssl verify client for specific domain name

There is no simple way to do this, unfortunately. Use a TCP frontend withouth SSL termination, SNI route to different backends that recirculate to traffic to dedicated SSL frontends with different configurations. Something like: frontend port443 bind :443 tcp-request inspect-delay 5s tcp-request content accept if { req_ssl_hello_type 1 } use_backend recir_clientcertenabled if { req_ssl_sni -i test1.demo.com } default_backend recir_default backend recir_clientcertenabled …

Hopefully, you can use a subdomain in a similar way because with a URI I can’t think of anything clever we can do as you will always need the client SSL settings in the frontend so users will always be prompted for a client cert…