<p>I successfully implemented in my aks cluster an ingress with tls certification (<a href="https://learn.microsoft.com/en-us/azure/aks/ingress-own-tls" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/aks/ingress-own-tls</a>), but I would like to pass the information contained in the client certificate to the backend.
I did try adding to my ingress the annotation <code>nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream: "true"</code>, but the information seems to be missing in my request headers (I am simply printing the content of <code>request.headers</code> from my flask application). Other headers are correctly shown, e.g. <code>X-Forwarded-Proto: https</code> or <code>X-Forwarded-Port: 443</code> .</p>

<p>Could somebody confirm the expected behaviour of the annotation?</p>

<p>Do I need to configure the backend somehow with tls as well?</p>

<p>EDIT</p>

<p>I did access the ingress pod, and in the nginx config I could not find any reference to <code>ssl_client_s_dn</code>, which I would expect to be the best candidate to pass the certificate info into an header.</p>

<p>I tried to assign some custom headers following the steps in <a href="https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/customization/custom-headers" rel="nofollow noreferrer">https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/customization/custom-headers</a>, but also this seems not to work.</p>

Neo
<p>Which version of <code>nginx-ingress</code> are you using ?</p>

<p>At least with version <code>0.30</code> I'm able too see the client's certificate details passed to the backend properly.</p>

<p>The value of <code>ssl_client_s_dn</code> is being passed as <code>Ssl-Client-Subject-Dn</code> header with default nginx controller setup, no customization needed.</p>

<p>Here is the content of my default <code>/etc/nginx/nginx.conf</code> (converted from ConfigMap)</p>

<pre><code># Pass the extracted client certificate to the backend

        proxy_set_header ssl-client-cert        $ssl_client_escaped_cert;

        proxy_set_header ssl-client-verify      $ssl_client_verify;
        proxy_set_header ssl-client-subject-dn  $ssl_client_s_dn;
        proxy_set_header ssl-client-issuer-dn   $ssl_client_i_dn;
</code></pre>

<p>Request headers seen from backend perspective:</p>

<pre><code>   ...
    "Ssl-Client-Issuer-Dn": "CN=example.com,O=example Inc.", 
    "Ssl-Client-Subject-Dn": "O=client organization,CN=client.example.com", 
    "Ssl-Client-Verify": "SUCCESS", 
    "User-Agent": "curl/7.58.0", 
    "X-Forwarded-Host": "httpbin.example.com", 
    "X-Scheme": "https", 
  }
}
</code></pre>

<p>You can always add your own custom headers, as explained <a href="https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/customization/custom-headers" rel="nofollow noreferrer">here</a></p>

<p>Example:</p>

<pre><code>apiVersion: v1
data:
  X-Client-Cert-Info: $ssl_client_s_dn
kind: ConfigMap
metadata:
...
</code></pre>

<p>which reflects at backend as:</p>

<pre><code>    ...
    "X-Client-Cert-Info": "O=client organization,CN=client.example.com", 
    "X-Forwarded-Host": "httpbin.example.com", 
    "X-Scheme": "https", 
  }
}
</code></pre>
