CertificateForwardingExtensions Class

Extension methods for configuring client certificate forwarding for mTLS support.

public static class CertificateForwardingExtensions

Inheritance System.Object → CertificateForwardingExtensions

Methods

CertificateForwardingExtensions.AddMtlsCertificateForwarding(this IServiceCollection, string, Action<CertificateForwardingOptions>) Method

Adds certificate forwarding middleware for mTLS when behind a reverse proxy. WARNING: Only use when behind a TRUSTED reverse proxy that validates client certificates. Improper configuration can allow certificate spoofing attacks.

public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddMtlsCertificateForwarding(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, string headerName="X-Client-Cert", System.Action<Microsoft.AspNetCore.HttpOverrides.CertificateForwardingOptions>? configure=null);

Parameters

services Microsoft.Extensions.DependencyInjection.IServiceCollection

The service collection.

headerName System.String

The header name containing the client certificate. Common values: "X-Client-Cert" (nginx), "X-Forwarded-Client-Cert" (Envoy), "X-SSL-Client-Cert"

configure System.Action<Microsoft.AspNetCore.HttpOverrides.CertificateForwardingOptions>

Optional callback to customize certificate parsing logic.

Returns

Microsoft.Extensions.DependencyInjection.IServiceCollection
The service collection for chaining.

Remarks

This method configures ASP.NET Core's built-in certificate forwarding with sensible defaults for common reverse proxy setups. The certificate can be in PEM or Base64-encoded DER format.

After calling this method, add app.UseCertificateForwarding() to your middleware pipeline BEFORE app.UseAuthentication().

Example:

services.AddMtlsCertificateForwarding("X-Client-Cert");

// In middleware pipeline:
app.UseCertificateForwarding(); // Before authentication
app.UseAuthentication();