HAProxy client SSL cert check non-local CA

[A Former User]

Hi all,

I hope I could get some help regarding this.

I have a pfSense that HAProxy is running in front of the server as the diagram. Between client system and server, client SSL certificate authentication is going to be used with http basic auth (username and password).

The same architecture will be multiplied and because of this, I'd like to have a single CA remotely instead of having internal CA on each pfSense boxes to manage certificates easily.

Now, when client system makes a request e.g., API call, I want HAProxy to check client certificate's validity via OCSP (or CRL whatever can be used). CA and OCSP will be in the same system.

Will this be possible? If so, could I please get some advice regarding how to do this? pfSense has the latest community edition.

Hope I can get some help. Thanks.

Eoin