Client Certificate Authentication

[CICADA-dev64bit]

we want to achieve client certificate authentication(mTLS), but we are not finding any APIs in the documentation

1. Is Client Certificate Authentication supported by GenHTTP?
2. Do we need to change the engine to Kestrel to achieve Client certificate authentication? If yes, can you please provide some snippets

[Kaliumhexacyanoferrat]

Client certfificate authentication is currently not possible via the API, neither in Kestrel nor in the internal engine. As this is not too complicated (allow to somehow set the RemoteCertificateValidationCallback on the SslServerAuthenticationOptions of the SslStream), I will create an issue for this and implement it in one of the next releases. Thanks for your input.

[Kaliumhexacyanoferrat]

As this is not implemented yet I cannot. Will be available in one of the next releases.

[CICADA-dev64bit]

okay thanks

[Kaliumhexacyanoferrat]

See #556

[Kaliumhexacyanoferrat]

@CICADA-dev64bit To give an update: There is a merge request that allows client authentication via API. This will require some polishing and testing, but I think we can release this feature during the next week.

[CICADA-dev64bit]

Hey @Kaliumhexacyanoferrat, thanks for updating me with the enhancements, waiting for the next release. Although I did some changes to support the mTLS and it was working as expected, if you are on it then I wont create PR.

Thanks for getting back so quick with the change

[Kaliumhexacyanoferrat]

This is great news - feel free to review my pull request to check whether it contains all the features you need and whether there is anything that can be solved in a more elegant way.

[Kaliumhexacyanoferrat]

Client Certificates are available in GenHTTP 9.1, see the documentation. There is also a new concern to authenticate on API level.