TLS reverse proxy with client certificate validation?

Question

I want to put an HTTP server behind a reverse proxy. This proxy should not only encrypt the data in the communication, but also demand and verify a client certificate.

Only clients with certificates signed by a local CA should be allowed to communicate to the server behind the proxy. All other data in the certificate can be ignored.

Is there any existing software that would perform such a task?

The main platform in use is Linux, but support for other UNIX platforms is a plus. I prefer Open Source over proprietary software.

Answer 1

Your web server likely already has this built in, but you could also use another service as a proxy if you really want to do so.

I have used Client Certificate Authentication in both Apache and Nginx, and both of them meet all of your requirements.

Answer 2

If you want to host on a Windows platform, then WinGate will do this for you. It can require a client to use a client cert for access to the reverse proxy, and it validates the user from the UserPrincipalName in the certificate against a matching Active Directory account.

Disclaimer: I work for Qbik, who are the authors of WinGate