diff options
| author | omnom62 <omnom62@outlook.com> | 2026-08-11 16:45:15 +1000 |
|---|---|---|
| committer | John Estabrook <jestabro@vyos.io> | 2026-08-26 13:33:34 -0500 |
| commit | 0cdf7e696b4deb3c3103a596bfe4d4f167dcf4b7 (patch) | |
| tree | 0d66820d71d2c193e1e7f44f73e7abfca2fa87cb /interface-definitions | |
| parent | f3012e652edef614d4f0ed169b320106a85d83b3 (diff) | |
| download | vyos-1x-0cdf7e696b4deb3c3103a596bfe4d4f167dcf4b7.tar.gz vyos-1x-0cdf7e696b4deb3c3103a596bfe4d4f167dcf4b7.zip | |
http-api: T8989: add mTLS client certificate authentication
Add support for mutual TLS (mTLS) authentication to the VyOS REST API.
When configured, nginx requests a client certificate and verifies it
against the configured CA chain. FastAPI reads the X-Client-Verify
header set by nginx and bypasses API key/token authentication when
the client certificate is valid.
Configuration:
set service https certificates ca-certificate <name>
set service https certificates verify-client <optional|required>
Note: requires TLSv1.2 due to nginx 1.22 TLSv1.3 post-handshake
authentication limitations. TLSv1.3 support pending nginx upgrade.
Diffstat (limited to 'interface-definitions')
| -rw-r--r-- | interface-definitions/service_https.xml.in | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/interface-definitions/service_https.xml.in b/interface-definitions/service_https.xml.in index f576444e9..d2cadeffe 100644 --- a/interface-definitions/service_https.xml.in +++ b/interface-definitions/service_https.xml.in @@ -199,6 +199,25 @@ #include <include/pki/ca-certificate.xml.i> #include <include/pki/certificate.xml.i> #include <include/pki/dh-params.xml.i> + <leafNode name="verify-client"> + <properties> + <help>Require client certificate verification (mTLS)</help> + <completionHelp> + <list>optional required</list> + </completionHelp> + <valueHelp> + <format>optional</format> + <description>Request but do not require client certificate</description> + </valueHelp> + <valueHelp> + <format>required</format> + <description>Require valid client certificate</description> + </valueHelp> + <constraint> + <regex>(optional|required)</regex> + </constraint> + </properties> + </leafNode> </children> </node> <leafNode name="tls-version"> |