Senior LevelWeb Security & Cyber Defense
How do API Gateways terminate mTLS and forward client certificate metadata to downstream services?
❓ Interview Prompt: Explain API Gateway mTLS termination, extracting client X.509 certificate SAN attributes, sanitizing injected client headers, and downstream proxy security.
When an API Gateway terminates mTLS connection handshakes at the edge:
Header Injection Security Pattern:
1
Gateway verifies client X.509 certificate against internal CA.
2
Gateway extracts client identity (Subject Alternative Name - SAN / Client CN) and injects it into upstream headers: 'X-Client-Cert-SAN: service-a.domain'.
3
CRITICAL SECURITY REQUIREMENT: The API Gateway MUST strip and sanitize any incoming 'X-Client-Cert-SAN' headers from external client requests before forwarding traffic to prevent header spoofing attacks!
Code Implementation Example
yaml
# NGINX Ingress Controller mTLS SAN Header Extraction Config
nginx.ingress.kubernetes.io/auth-tls-verify-client: "on"
nginx.ingress.kubernetes.io/auth-tls-secret: "default/ca-secret"
nginx.ingress.kubernetes.io/configuration-snippet: |
more_set_input_headers "X-Client-Cert-DN: $ssl_client_s_dn";💡NGINX configuration extracting mTLS client certificate DN into upstream headers.
🎯 Interview Key Takeaway
Always strip external client headers at the API Gateway before injecting verified mTLS certificate metadata for upstream microservices.
#mTLS Termination#API Gateway#NGINX#Senior
Back to all Web Security & Cyber Defense Questions→