How to retrieve client certificate passed by Apache proxy

Question

Hi all,
Here's my configuration:
Client <--HTTPS-->Apache Proxy (2-way SSL) <-- HTTP --> WLS 8.1
I need to be able to access the client certificate passed to Apache by the client in my Java applications hosted on WLS.
Here's what I did:-
<pre>1. Set up Apache 2-way SSL. Tested ok.
2. Set up Apache-Weblogic proxy. Tested ok for both HTTP, and server-side HTTPS.
3. Configured Apache's ssl.conf SSLOption to export certifiate data: SSLOptions +ExportCertData.
4. In my application, I used request.getAttribute("javax.servlet.request.X509Certificate") to try and retrieve the certificate.</pre>
However the certificate don't seem to be passed along to Weblogic :-(
Any ideas if I'm missing any steps from above? Or if it's even possible to do this?
Thanks for any suggestions!
Any ideas

Answer 1

The WL-Client-Proxy cert should be the cert used on the proxy side if SSL is configured between Apache and WebLogic, so I believe that is the reason why that does not work. Basically, the problem here is that SSL is end-to-end, and the two ends of this transaction are the client and apache.
That said, when you add the +ExportCertData option, this should record the client's SSL certificate in the vairable SSL_CLIENT_CERT.  So you should be able to use request.getAttribute("SSL_CLIENT_CERT").
See:
http://www.modssl.org/docs/2.8/ssl_reference.html
If this doesn't work for you (which is possible if the WL_Proxy is doing something funny to the request), it is probably best just to dump out the entire contents of the session, and see what you have:
for (Enumeration e = request.getAttributeNames() ; e.hasMoreElements() ; ) {
String attr = (String)e.nextElement();
System.out.println("ATTR = " + attr);
System.out.println("VAL = " + request.getAttribute(attr));
If you can't see any SSL certificate there, you will have to work out some way to pass this on manually.
cheers,
Trevor