Fossil Forum
Post: Client certificate how to request
In https://www.fossil-scm.org/home/doc/trunk/www/ssl.wiki it's talked about that a server should be configured to accept client certificates, how does one do that? is this possible with the fossil server command? is this a setting?
i currently have a fossil server --port 8090 repo.fossil --cert server.pem --pkey server.key that is serving the repo on https but i would like to enable this paranoia mode.
is this [client certificates] possible with the fossil server command?
No, if you read the fine print in that Wiki page you'll see:
Without presenting a valid client side certificate, the web server won't invoke the Fossil CGI handler.
This implies that you're using a mechanism other than "fossil server".
It's been a long time since I setup peer certificates with Fossil, however, once you get your HTTP server configured you'll want to look into the "fossil ssl-identity" command for configuring the client:
https://www.fossil-scm.org/home/help/ssl-identity
Thank you for your quick reply, you have saved me a lot of time knocking on the wrong door.
I don't think the page is clear enough in stating the implications you mention, maybe a point of improvement for the documentation.
From what you are saying then i should be looking at putting the fossil server behind a reverse proxy like nginx or caddy, and letting that handle the certification, the other assumption is that the fossil server is maybe running in scgi mode?
I don't think the page is clear enough
Yes; that doc dates from the time when Fossil had no server-side TLS support, and when it was reworked to add it, the distinction was not clearly made that this is one solid case where delegating TLS to an RP remains justified.
The details are RP-specific, but a better sketch of the process may be found by searching for "mTLS" in that doc.
i should be looking at putting the fossil server behind a reverse proxy like nginx or caddy
Those are two of several options, yes. I documented the nginx option many years ago, and I've updated it since to track external changes. I'm still using that same scheme on my public site, except that I've containerized the underlying fossil server instances. I don't use mTLS on that server, though, so that detail you'll have to work out on your own.
the fossil server is maybe running in scgi mode?
For nginx, yes, that's required, for lack of old-school CGI. Caddy does appear to support CGI, but I believe nginx was right to drop it, on excess latency grounds.
Thank you very much, you have given me a lot of clues to contiune, specially mTLS
i should be looking at putting the fossil server behind a reverse proxy like nginx or caddy,
That's one option. Another option is to just use stunnel (or similar SSL wrapping server) with an appropriate setting for "verify".