Client certificate based authentication is not working (-cc, -ck, -ca)

[forgedhallpass]

Command:

nuclei -id http-missing-security-headers -ca server.crt -cc client.crt -ck client.key -v -debug -u https://localhost:8443
...
[WRN] [http-missing-security-headers] Could not execute request for https://localhost:8443: GET https://localhost:8443 giving up after 2 attempts: Get "https://localhost:8443": remote error: tls: bad certificate

Same certificates are working with curl or the go client test below:

curl -k --cert client.crt --key client.key --cacert server.crt https://localhost:8443

Steps to reproduce

Generate the required certificates:

# Server
openssl genpkey -algorithm RSA -out server.key
openssl req -new -key server.key -out server.csr
openssl x509 -req -signkey server.key -in server.csr -out server.crt

# Client
openssl genpkey -algorithm RSA -out client.key
openssl req -new -key client.key -out client.csr
openssl x509 -req -in client.csr -CA server.crt -CAkey server.key -CAcreateserial -out client.crt

Create a test server:

package main

import (
	"crypto/tls"
	"crypto/x509"
	"fmt"
	"net/http"
	"os"
)

func main() {
	serverCert, _ := tls.LoadX509KeyPair("server.crt", "server.key")

	certPool := x509.NewCertPool()
	caCert, _ := os.ReadFile("server.crt")
	certPool.AppendCertsFromPEM(caCert)

	server := &http.Server{
		Addr: ":8443",
		TLSConfig: &tls.Config{
			Certificates: []tls.Certificate{serverCert},
			ClientAuth:   tls.RequireAndVerifyClientCert,
			ClientCAs:    certPool,
		},
	}

	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
		if len(r.TLS.PeerCertificates) == 0 {
			http.Error(w, "Client certificate required", http.StatusForbidden)
			return
		}

		fmt.Fprintf(w, "Hello, %s!\n", r.TLS.PeerCertificates[0].Subject)
	})

	server.ListenAndServeTLS("server.crt", "server.key")
}

Create a go client for testing:

package main

import (
	"fmt"
	"io"
	"os"
	"testing"
)

import (
	"crypto/tls"
	"crypto/x509"
	"log"
	"net/http"
)

func TestMTLSAuthentication(t *testing.T) {

	cert, _ := tls.LoadX509KeyPair("client.crt", "client.key")
	caCert, _ := os.ReadFile("server.crt")

	caCertPool := x509.NewCertPool()
	caCertPool.AppendCertsFromPEM(caCert)

	client := &http.Client{
		Transport: &http.Transport{
			TLSClientConfig: &tls.Config{
				Certificates:       []tls.Certificate{cert},
				RootCAs:            caCertPool,
				InsecureSkipVerify: true,
			},
		},
	}

	response, err := client.Get("https://localhost:8443")
	if err != nil {
		log.Fatal(err)
	}
	defer response.Body.Close()

	responseBody, err := io.ReadAll(response.Body)
	if err != nil {
		log.Fatal(err)
	}

	fmt.Println(response.Header)
	fmt.Println(string(responseBody))
}

It would also be nice to add an integration test scenario.

Related:

• Allow Client Authentication #1170
• [Bug] Improving error handling in client certificate helper library #1237