net/haproxy: add support for client certificate authentication

[fraenki]

Via forum post.

Examples:
https://www.haproxy.com/blog/ssl-client-certificate-management-at-application-level/
http://www.loadbalancer.org/blog/client-certificate-authentication-with-haproxy/

[mohnewald]

... we are really interested in this feature, too. :-)

[officebluesource]

here, too!

[mahescho]

Count me in, how can I help?

[fraenki]

@mahescho Currently nobody is working on this. If you are able to help developing this feature, please submit a pull-request; I'd gladly review your work :)

[fabianfrz]

Or as an alternative, the nginx plugin supports it. (please note that it targets different use cases)

[mahescho]

As I will not use the load balancing feature any way I will have a look at NginX. As I really like HA proxy I will have a look at the source when I find some time. Very basic support should not be to hard to implement.

[officebluesource]

will there be an approx. timeframe for implementation?
thanks!

[fraenki]

@bluesource, in case you missed it:

Currently nobody is working on this.

No ETA :)

[mohnewald]

Would someone be willing/motivated to add this feature for some beer or money? :)

[fraenki]

Due to popular demand this feature will be available in the upcoming os-haproxy release 2.10:

If someone is willing to test it, please apply the current development code:

$ opnsense-patch -c plugins 813dfc2b
$ opnsense-patch -c plugins d3fae338

I did a quick test and it seems to work as expected:

$ openssl s_client -connect opnsense.example.com:8443 -cert clientcert1.crt -key clientcert1.key