QHttpServer with mutual TLS authentication

[tomas.soltys]

Hi,

I have a Https server to which only a client with valid certificate can connect. That works well. But is there a way to retrieve a connecting client's certificate details? My goal is to authorize the client based on the value of Common Name in certificate subject.

QHttpServer *pHttpServer = new QHttpServer(this);

pHttpServer->route("/", [](const QHttpServerRequest &request) {
    // Here validation of client CN should be performed
    // But how to get an access to QSslSocket for given QHttpServerRequest
    return "Server";
});

const auto caCertificates = QSslCertificate::fromPath(caCertificateFileName,QSsl::EncodingFormat::Pem);
const auto clientCertificates = QSslCertificate::fromPath(clientCertificateFileName,QSsl::EncodingFormat::Pem);
QFile privateKeyFile(keyFileName);
privateKeyFile.open(QIODevice::ReadOnly);
QSslKey privateKey(&privateKeyFile,QSsl::Rsa,QSsl::Pem,QSsl::PrivateKey,tlsKeyStoreFile);

QSslConfiguration sslConfig;
sslConfig.setCaCertificates(caCertificates);
sslConfig.setLocalCertificateChain(clientCertificates);
sslConfig.setPrivateKey(privateKey);
sslConfig.setProtocol(QSsl::TlsV1_3OrLater);
sslConfig.setPeerVerifyMode(QSslSocket::VerifyNone);

pHttpServer->sslSetup(sslConfig);
const quint16 port = pHttpServer->listen(QHostAddress::Any,12345);

I think I need to get access to QSslSocket which can then further provide certificate details, but I haven't found a way how to do it from within the lambda function handling the request.

Thanks for help,
Tomas

[SPQt]

@tomas-soltys
"I think I need to get access to QSslSocket which can then further provide certificate details"

Find QHttpServer source code. I mean QHttpServer.cpp and QHttpServer.h

Modify the code so that you can get QSslSocket object. Then you can use:

QSslCertificate QSslSocket::peerCertificate() const
"Returns the peer's digital certificate (i.e., the immediate certificate of the host you are connected to), or a null certificate, if the peer has not assigned a certificate.".

I have question to you: what version of Qt and openssl you use.

Look at my post: maybe you can help me to get read of ssl connection issue . Link: https://forum.qt.io/topic/150462/qhttpserver-api-https-openssl-letsencrypt-sslv3-alert-handshake-failure-alert-number-40/6?_=1697291376846