# Restrict access to some part of the site with certificate

**URL:** <https://discourse.haproxy.org/t/restrict-access-to-some-part-of-the-site-with-certificate/2273>\
**Category:** Help!\
**Created:** [March 20, 2018, 12:03am UTC](https://discourse.haproxy.org/t/restrict-access-to-some-part-of-the-site-with-certificate/2273 "2018-03-20T00:03:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Senanito](https://avatars.discourse-cdn.com/v4/letter/s/cdc98d/32.png) [@Senanito](https://discourse.haproxy.org/u/Senanito)\
**Post date:** [March 20, 2018, 12:03am UTC](https://discourse.haproxy.org/t/restrict-access-to-some-part-of-the-site-with-certificate/2273/1 "2018-03-20T00:03:54Z")

</div>

Hi, all

I have a task to restrict access to some part of the site with a certificate.  
I have written something after reading posts of @AaronWest and @lukastribus  
however, have to admit that didn’t understand it solely.

Let’s say url for all users: [https://tapprod.com](https://tapprod.com)  
Restricted part: [https://tapprod.com/tier2/rest/](https://tapprod.com/tier2/rest/)  
my backend server lets call: tapprodsrv-02 with ip 172.20.20.20

Here is my config:

```
defaults
            mode http

frontend HTTPS-IN
	bind 172.20.10.10:443
	tcp-request inspect-delay 5s
	tcp-request content accept if { req_ssl_hello_type 1 }
	use_backend HTTP-OUT-CERT if { req_ssl_sni -i /tier2/rest/ }
	default_backend HTTP-OUT-NOCERT

backend TAPPROD-HTTP-OUT-CERT
      server loopback-for-tls abns@haproxy-clientcert send-proxy-v2
backend TAPPROD-HTTP-OUT-NOCERT
      server loopback-for-tls abns@haproxy-default send-proxy-v2

frontend fe-ssl-clientcert
	mode http
	bind abns@haproxy-clientcert accept-proxy ssl crt /etc/haproxy/ssl/tapprod.pem ca-file /etc/haproxy/ssl/tap-ca.crt verify required 
	use_backend APPSR01

frontend fe-ssl-default
	mode http
	bind abns@haproxy-default accept-proxy ssl crt /etc/haproxy/ssl/tapprod.pem
	use_backend APPSR01

backend APPSR01
	server tapprodsrv-02 172.20.20.20:443 check ssl verify none

```

Came to this point after reading and trying to understand this discussion:

> [@How to set ssl verify client for specific domain name](https://discourse.haproxy.org/t/how-to-set-ssl-verify-client-for-specific-domain-name/1489/3):
>
> There is no simple way to do this, unfortunately. Use a TCP frontend withouth SSL termination, SNI route to different backends that recirculate to traffic to dedicated SSL frontends with different configurations. Something like: frontend port443 bind :443 tcp-request inspect-delay 5s tcp-request content accept if { req\_ssl\_hello\_type 1 } use\_backend recir\_clientcertenabled if { req\_ssl\_sni -i test1.demo.com } default\_backend recir\_default backend recir\_clientcertenabled …

As I understand it creates one more loop using loopback interface to segregate two different traffic.  
I guess “abns@haproxy-clientcert” and “abns@haproxy-default” is marking different traffic.  
And then loadbalancer listens to traffic coming to loopback interface to redirect it.  
But original posts never point to actual backend servers, so I modified it. Not sure if its correct.

Please help to understand and make it work.  
Thank you

---

<div class="post-metadata">

**Author:** ![Senanito](https://avatars.discourse-cdn.com/v4/letter/s/cdc98d/32.png) [@Senanito](https://discourse.haproxy.org/u/Senanito)\
**Post date:** [March 20, 2018, 1:43am UTC](https://discourse.haproxy.org/t/restrict-access-to-some-part-of-the-site-with-certificate/2273/2 "2018-03-20T01:43:46Z")

</div>

Just for the reference if someone needs it.  
Seems like have solved it this way so far:

frontend TAPPROD-HTTPS-IN  
mode http  
bind 172.20.20.20:443 ssl crt /etc/haproxy/ssl/tapprod.pem ca-file /etc/haproxy/ssl/ca-chain.crt verify optional  
acl restricted\_path path\_beg /tier2/rest/  
http-request deny if restricted\_path !{ ssl\_c\_used 1 } || restricted\_path !{ ssl\_c\_verify 0 }  
use\_backend TAPPROD-HTTP-OUT

---

<div class="post-metadata">

**Author:** ![AaronWest](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/aaronwest/32/164_2.png) [@AaronWest](https://discourse.haproxy.org/u/AaronWest)\
**Post date:** [March 20, 2018, 11:48am UTC](https://discourse.haproxy.org/t/restrict-access-to-some-part-of-the-site-with-certificate/2273/3 "2018-03-20T11:48:25Z")

</div>

Hi Senanito,

Sorry I didn’t get back to you in time, however, your solution looks good to me.

---

<div class="post-metadata">

**Author:** ![hussain](https://avatars.discourse-cdn.com/v4/letter/h/f17d59/32.png) [@hussain](https://discourse.haproxy.org/u/hussain)\
**Post date:** [March 11, 2020, 1:13am UTC](https://discourse.haproxy.org/t/restrict-access-to-some-part-of-the-site-with-certificate/2273/4 "2020-03-11T01:13:53Z")

</div>

Hi Senanito,

I too have similar setup,do i have to include this ‘frontend TAPPROD-HTTPS-IN’ section along with above config which you have defined in desc as your config file ?..Can you share the complete config file which made it work