]> git.ipfire.org Git - thirdparty/haproxy.git/commit
DOC: proxy-protocol: Add SSL client certificate TLV
authorSimon Ser <contact@emersion.fr>
Mon, 19 Jan 2026 23:38:11 +0000 (23:38 +0000)
committerWilly Tarreau <w@1wt.eu>
Tue, 20 Jan 2026 07:11:19 +0000 (08:11 +0100)
commit6f5def3cbd88b242ce33ad051897f98463a8026e
tree821e2e2f42e5d4d79bbdfa43926ce6a9e0b2eb94
parent9156d5f77582d2896fda9e77e08c065f88256e73
DOC: proxy-protocol: Add SSL client certificate TLV

Add the PP2_SUBTYPE_SSL_CLIENT_CERT code point reservation in the
proxy protocol specification. This is useful in cases where the
backend needs to perform mTLS authentication, but the rules for
certificate validation are backend-specific (e.g. database of
allowed certificate hashes).

This is left optional to leave it up to the frontend configuration
to dictate whether to forward raw certificate data.

Support for this new TLV has been added in tlstunnel:
https://codeberg.org/emersion/tlstunnel/pulls/33
doc/proxy-protocol.txt