TLS handshake error: failed to verify client's certificate

[simonsparks]

Hi, I've been trying to set up client authentication, as discussed previously in #106, and have managed to successfully authenticate a local self signed certificate via Firefox browser interaction.

However, my primary use case is to restrict access to calls from AWS API Gateway which may include it's own generated client certificates. In this case, when attempting to make a call via the gateway, Fabio logs the following error:

2016/06/07 12:56:01 http: TLS handshake error from 52.30.177.125:47122: tls: failed to verify client's certificate: x509: certificate signed by unknown authority (possibly because of "x509: invalid signature: parent certificate cannot sign this kind of certificate" while trying to verify candidate authority certificate "ApiGateway")

This looks similar to the problem described in this SO post where the client certificate had to be marked as IsCA.

Is there a way of achieving this in Fabio through configuration, if this is in fact the same problem?

[magiconair]

@simonsparks without trying this myself I'd say this looks like this problem. When I generate a test certificate I always have to set IsCA and add x509.KeyUsageCertSign to the KeyUsage for the verification to work. The question is whether fabio should "fix" the cert on the fly which may be valid for some and invalid for other certs. Or whether it should provide a tool to "fix" the cert. I can't just assume that all client auth certificates are self-signed certs for the AWS API Gateway.

[simonsparks]

@magiconair Yes, that's a fair comment. I agree it can't be assumed that all client certs would require this conversion.
Would such a tool be able to parse the pem content, modify the structure as appropriate, and serialize out to a modified pem file which could be used in Fabio? Not being too familiar with go programming and it's crypto package, I don't know if this is how it would work.

[magiconair]

Lets first see whether this works. I'll push a patch in a minute for testing. Are you comfortable building a fabio binary yourself or do you rely on a pre-built or docker image?

[simonsparks]

I'm building Amazon AMIs with Packer.
Fabio is currently installed from a script which runs: go get github.com/eBay/fabio

p.s. really appreciate your support!

[magiconair]

I can upload a binary to github and you could replace go get temporarily with wget. Would that work? I assume linux_amd64 ...

[magiconair]

or can you ssh into your AMI instance and replace the binary? Sorry, I'm a total AWS noob.

[simonsparks]

I can log in to the deployed servers and manually update fabio for the time being.

[magiconair]

BTW, I've just created https://fabiolb.slack.com/ . Might be a good use case to test this.

[simonsparks]

That would be good. I'd be happy to test.

[magiconair]

I am a bit torn about the slack channel since it splits the discussions across multiple mediums. Now others don't see the discussion we had there. OTOH, chat provides a mechanism for others to participate. I've added a Gitter (https://gitter.im/eBay/fabio) link to the README. Someone has used that before but I forgot about it Lets see whether that picks up. So far I'm OK with responding to issues but I'm curious what others think.