<p>I have an application set up like this:</p>

<p><a href="https://i.stack.imgur.com/WDQeq.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/WDQeq.png" alt="enter image description here"></a></p>

<p>There is a server, with a reverseproxy/load balancer that acts as the HTTPS termination (this is the one that has a server certificate), and several applications behind it(*)</p>

<p>However, some applications require authentication of the client with a certificate. Authentication cannot happen in the reverse proxy. Will the application be able to see the user certificate, or will it be jettisoned by the HTTPS->HTTP transfer?</p>

<p>(*) OK, so this is a Kubernetes ingress, and containers/pods.</p>

<p>It will be lost. I think you need to extract it in the reverse proxy (i.e. Nginx) and pass it in as a HTTP header if you really must. See for example <a href="https://serverfault.com/questions/788895/nginx-reverse-proxy-pass-through-client-certificate">https://serverfault.com/questions/788895/nginx-reverse-proxy-pass-through-client-certificate</a>. Not very secure as the cert is passed in the clear!</p>

<p>I don't know if we have that level of control over the ingress, personally I'm using a normal Nginx server for incoming traffic instead.</p>
