diff options
| author | omnom62 <omnom62@outlook.com> | 2026-08-11 16:45:15 +1000 |
|---|---|---|
| committer | John Estabrook <jestabro@vyos.io> | 2026-08-26 13:33:34 -0500 |
| commit | 0cdf7e696b4deb3c3103a596bfe4d4f167dcf4b7 (patch) | |
| tree | 0d66820d71d2c193e1e7f44f73e7abfca2fa87cb /scripts | |
| parent | f3012e652edef614d4f0ed169b320106a85d83b3 (diff) | |
| download | vyos-1x-0cdf7e696b4deb3c3103a596bfe4d4f167dcf4b7.tar.gz vyos-1x-0cdf7e696b4deb3c3103a596bfe4d4f167dcf4b7.zip | |
http-api: T8989: add mTLS client certificate authentication
Add support for mutual TLS (mTLS) authentication to the VyOS REST API.
When configured, nginx requests a client certificate and verifies it
against the configured CA chain. FastAPI reads the X-Client-Verify
header set by nginx and bypasses API key/token authentication when
the client certificate is valid.
Configuration:
set service https certificates ca-certificate <name>
set service https certificates verify-client <optional|required>
Note: requires TLSv1.2 due to nginx 1.22 TLSv1.3 post-handshake
authentication limitations. TLSv1.3 support pending nginx upgrade.
Diffstat (limited to 'scripts')
0 files changed, 0 insertions, 0 deletions