title: Client certificate based authentication HAProxy and a general questions
body: <p>I want to add to a Tomcat servlet (which is behind a HAProxy server) client based authentication so what I did was</p>
  <p>I've updated Tomcat configuration by adding</p>
  <pre><code>&lt;Connector port=&quot;18443&quot; protocol=&quot;HTTP/1.1&quot; SSLEnabled=&quot;true&quot;
          maxThreads=&quot;150&quot; scheme=&quot;https&quot; secure=&quot;true&quot;
          clientAuth=&quot;want&quot; sslProtocol=&quot;TLS&quot;
          keystoreFile=&quot;conf/cert/server-keystore.jks&quot;
          keystorePass=&quot;changeit&quot;
          truststoreFile=&quot;conf/cert/server-truststore.jks&quot; 
          truststorePass=&quot;changeit&quot; /&gt;
  </code></pre>
  <p>P.S more info on <a href="https://docs.bmc.com/docs/rsso1908/configuring-the-tomcat-server-for-certificate-based-authentication-907302408.html" rel="nofollow noreferrer">https://docs.bmc.com/docs/rsso1908/configuring-the-tomcat-server-for-certificate-based-authentication-907302408.html</a></p>
  <p>I also updated my HAProxy configuration by updating several lines, i.e</p>
  <pre><code>listen VIP
      bind 172.16.200.85:443 transparent ssl crt /etc/haproxy/cert/server.pem ca-file /etc/haproxy/cert/ca.crt verify required crl-file /etc/haproxy/cert/root_crl.pem
  </code></pre>
  <p>P.S more info on <a href="https://www.loadbalancer.org/blog/client-certificate-authentication-with-haproxy/" rel="nofollow noreferrer">https://www.loadbalancer.org/blog/client-certificate-authentication-with-haproxy/</a></p>
  <p>and when I navigate to a page I get prompted for a certificate immediately, and I don't want that. What I want is a specific path, i.e <strong>/login/me</strong> to prompt for a certificate to choose. Basically, I want the same solution for client certificate authentication as on</p>
  <pre><code>https://secure.login.gov/  
      --&gt; select &quot;Sign in with your government employee ID&quot; 
      --&gt; click on the button &quot;Insert your PIV/CAC&quot; [you get a certificate list to choose from]
  </code></pre>
  <p>My questions:</p>
  <p><em>How they are able to to accomplish client certificate based authentication via (it seems) a path &quot;/login/piv_cac&quot;?</em></p>
  <p>I'm asking this, because I've found answers on a stackoverflow <a href="https://stackoverflow.com/questions/14937833/configure-tomcat-for-client-authentication-only-for-specific-url-patterns">configure tomcat for client authentication only for specific URL patterns</a> that this is not possible to accomplish. I've also tried my self, but I get always prompted for a client certificate upon connecting to a Tomcat instance (before navigating to an authentication url)</p>
  <p><em>Is it doable with two Tomcat instances behind a HAProxy?</em></p>
  <p><em>If so, what would be a general HAProxy configuration [or steps] for this?</em></p>
  <p><em>If not, what do I need to make it happen?</em></p>
  <p><em>Do I need one Tomcat instance for &quot;casual&quot; human beings and other Tomcat instance for &quot;certified&quot; human beings?</em></p>