IIS反向代理与源服务器间客户端证书认证配置咨询

Absolutely feasible! I’ve helped folks set up this exact mutual TLS (mTLS) scenario with IIS reverse proxy before, so let’s break down how to make it work since you already have the client-to-IIS mutual auth sorted.

1. Prerequisites First #

Before diving in, confirm these are in place:

• ARR & URL Rewrite Modules: These are mandatory for IIS reverse proxy functionality. If you haven’t installed them yet, grab them via the IIS Manager’s "Web Platform Installer".
• Origin Server Trust: Import the origin server’s CA root certificate (or its specific server cert if self-signed) into your IIS server’s Trusted Root Certification Authorities store. This lets IIS trust the origin’s HTTPS certificate.
• IIS Client Certificate: Import a client certificate (that the origin server will trust) into your IIS server’s Personal certificate store. This is the cert IIS will present to the origin for authentication.

2. Configure ARR to Pass Client Certificate to Origin #

• Open IIS Manager, select your server node in the left Connections pane.
• Double-click Application Request Routing Cache.
• In the right Actions pane, click Server Proxy Settings.
• Navigate to the SSL Settings section:
  • Check Require SSL (since your origin uses HTTPS).
  • Click Change next to the Client Certificate option.
  • Select Use a specific client certificate, then pick the cert you imported into the Personal store. This tells IIS to send this cert when connecting to the origin.
  • Hit OK to save these settings.

3. Verify URL Rewrite Rules for HTTPS Backend #

• If you don’t have a reverse proxy rule yet:
  1. Select your website in IIS Manager, double-click URL Rewrite.
  2. Click Add Rule(s) > Reverse Proxy.
  3. Enter your origin server’s full HTTPS URL (e.g., https://your-origin-server.com), and ensure the rule is set to forward requests over HTTPS.
• For existing rules:
  • Edit the rule to confirm the Rewrite URL uses https:// for the origin.
  • Optional: Add a server variable HTTP_X_FORWARDED_PROTO set to https to pass the original protocol to the origin.

4. Configure the Origin Server to Trust IIS’s Cert #

• On the origin server, import IIS’s client certificate (or its issuing CA root) into its Trusted Root Certification Authorities (and optionally Trusted People) store.
• Set up the origin’s web server (whether it’s IIS, Apache, etc.) to require client certificates for incoming HTTPS requests—this mirrors the client-to-IIS auth you already configured.

5. Test the End-to-End Flow #

• Use tools like curl (with your client cert) or Postman to send a request to IIS as you normally do.
• Check if the request successfully reaches the origin server. You can enable ARR logs on IIS and access logs on the origin to troubleshoot any connection failures (e.g., certificate trust issues).

Quick note: If your origin uses a self-signed certificate, double-check that IIS’s Trusted Root store has the origin’s root CA—otherwise IIS will reject the origin’s cert and drop the connection.

内容的提问来源于stack exchange，提问作者Vrushank