Demo
Demo

Knowledge base

PMTA knowledge base›Block Global›Directive§ 3.3.1.58.17

http-tls-request-client-certificate

Globalrestart required

Whether to ask the client for a certificate when it connects to the web monitor
in the configuration this is a linehttp-tls-request-client-certificate trueinside the block Global
Asking whoever arrives for a certificate

In a TLS handshake the server can ask the client for a certificate too. The monitor asks by default — we checked this on a fleet node: the handshake includes a CertificateRequest, which, for comparison, an ordinary web server does not send.

Asking does not mean requiring. The client may answer with an empty certificate, and the connection continues. That is exactly why the browser shows a certificate selection window out of nowhere — the manual names this as the main reason to turn the line off.

Only the monitor has this line. Neither mail receiving nor the listeners have such a switch: there a client certificate is either configured via tls-certificate-san-or-cn for a login or not requested.

Be careful with the vendor’s management console. The manual warns: turning it off interferes with PMC — the vendor’s console, which identifies itself precisely with a certificate.

The main trap is taking the certificate selection window for a malfunction. The browser shows it because the monitor asked, not because something is misconfigured. People start looking for the problem in the browser.
What the Hub does. It does not write it: the Hub does not identify itself with a certificate, it presents the management key in a header. The line would still be in force if someone opened the monitor in a browser over https — then the selection window will appear.
Recommended values

The choice depends on who connects to the monitor:

Value When
true (default) you use the PMC console
false you connect with a browser and the selection window gets in the way

Neither changes access rights — they are set by http-access and the management key.

The default true and the warning about PMC are from the manual (§ 3.3.1.58.17). That the request is actually sent is our check on a fleet node.
Example configuration
# the certificate selection window gets in the way, and we do not use the PMC console
http-mgmt-port 1000
http-tls-request-client-certificate false
The value is worth changing only when both conditions hold at once. With PMC, turning it off breaks the console’s own way of identifying itself.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends2 mistakes▶

Turning the request off on a node where the PMC console works

§ 3.3.1.58.17

What it costsThe console identifies itself precisely with a certificate. Without the request it has nothing to prove who it is with, and the link to the node breaks.
How to spot itPMC stops seeing the node right after the monitor restarts.
How to do it rightSet true back. The selection window in the browser is cured by installing a certificate in the browser, not by turning the request off.

Expecting the request to lock out strangers

our experience

What it costsThe monitor asks but does not require: the client answers with an empty certificate and continues. This does not change rights.
How to spot itThe line is set, but a stranger from an allowed address gets in.
How to do it rightRestrict access via http-access and the management key.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
Syntax
http-tls-request-client-certificate <boolean>
Values
yes | no | true | false
Default
true § 3.3.1.58.17
Applying
a service restart is required
Queue
will not touch what is already queued
Where to write it
Global
How many times
once in the block
Everything here comes from the manual, with the section.
Inheritance
The directive has no inheritance: it is written at the root of the file, the Global section, and applies to the node’s whole management interface.
⇄

Related directives

2 relations

Works together with

http-tls-ca-fileGlobalThe certificate the monitor asks for is verified against the authorities in that file. inference

Applies to

http-mgmt-portGlobalOne of the settings of the very interface that listens on this port. § 3.3.1.58.17

How to check on the node
The request is visible in the handshake itself — you only need to ask OpenSSL to print the protocol messages:
openssl s_client -connect NODE:1000 -msg </dev/null | grep -c CertificateRequest
1 — the monitor asks for a certificate, 0 — it does not. The same command against an ordinary web server gives 0, so the check distinguishes the cases rather than always showing the same thing.
◇

What else to read

3 articles

◇Who is allowed to submit mail and for whom to accept itOut of the box, the node accepts submission only from the machine itself; two different questions — “who can send through us” and “for whose addresses we accept mail” — are answered by different directives.◇The group that grants management rightsMembership in the pmta group gives an unprivileged user the right to call the node’s commands and use submission.◇How the node selects a source and combines its settingsA connection falls under all source blocks whose addresses cover it, and they act merged — the narrow one overrides the wide one; named blocks are attached only by direct reference.

In the Hub
Cost of a mistake
safe: a wrong value breaks nothing
Scenarios
Node security
Neighboring settings of the block Global:smtp-server-tls-certificateopenssl-security-levelsmtp-server-tls-min-versionhttp-tls-min-versionsmtp-server-tls-cipher-server-preferenceAll 108 directives of the block →