From 0cdf7e696b4deb3c3103a596bfe4d4f167dcf4b7 Mon Sep 17 00:00:00 2001
From: omnom62 <omnom62@outlook.com>
Date: Tue, 11 Aug 2026 16:45:15 +1000
Subject: http-api: T8989: add mTLS client certificate authentication

Add support for mutual TLS (mTLS) authentication to the VyOS REST API.

When configured, nginx requests a client certificate and verifies it
against the configured CA chain. FastAPI reads the X-Client-Verify
header set by nginx and bypasses API key/token authentication when
the client certificate is valid.

Configuration:
  set service https certificates ca-certificate <name>
  set service https certificates verify-client <optional|required>

Note: requires TLSv1.2 due to nginx 1.22 TLSv1.3 post-handshake
authentication limitations. TLSv1.3 support pending nginx upgrade.
---
 interface-definitions/service_https.xml.in | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

(limited to 'interface-definitions')

diff --git a/interface-definitions/service_https.xml.in b/interface-definitions/service_https.xml.in
index f576444e9..d2cadeffe 100644
--- a/interface-definitions/service_https.xml.in
+++ b/interface-definitions/service_https.xml.in
@@ -199,6 +199,25 @@
               #include <include/pki/ca-certificate.xml.i>
               #include <include/pki/certificate.xml.i>
               #include <include/pki/dh-params.xml.i>
+              <leafNode name="verify-client">
+                <properties>
+                  <help>Require client certificate verification (mTLS)</help>
+                  <completionHelp>
+                    <list>optional required</list>
+                  </completionHelp>
+                  <valueHelp>
+                    <format>optional</format>
+                    <description>Request but do not require client certificate</description>
+                  </valueHelp>
+                  <valueHelp>
+                    <format>required</format>
+                    <description>Require valid client certificate</description>
+                  </valueHelp>
+                  <constraint>
+                    <regex>(optional|required)</regex>
+                  </constraint>
+                </properties>
+              </leafNode>
             </children>
           </node>
           <leafNode name="tls-version">
-- 
cgit v1.2.3