X.509 Configuration
The released Caddy Security v1.3.0 / go-authcrunch v1.3.8 adapter does not expose an X.509 identity provider that turns a client certificate into a portal user or JWT. Its login integrations are local, LDAP, OAuth/OIDC and SAML. An old placeholder page is not evidence of certificate-login support.
A certificate’s purpose determines what it proves. A server TLS certificate identifies the HTTPS endpoint. A client certificate can be checked at Caddy’s TLS layer, and a SAML certificate pins the IdP’s signing key. None of those alone implements an AuthCrunch X.509 login provider or grants application roles.
Choose the certificate's purpose
| Certificate/key use | Owning layer | What it proves |
|---|---|---|
| Server HTTPS certificate | Caddy TLS | The browser/server TLS identity |
| Required, verified client certificate | Caddy TLS client authentication | A client holds a key trusted by the configured TLS policy |
| SAML IdP signing certificate | SAML provider | An assertion is signed by the separately pinned IdP key |
| Portal JWT signing key/public JWKS | Token verification | A token's issuer/key signature, subject to policy validation |
Caddy's TLS client-authentication controls support requiring and verifying client certificates against a configured trust pool. Requiring a certificate without verification is a different mode; choose and test the intended trust boundary using the exact Caddy version you run.
Combine transport and application access
A verified client certificate can gate the TLS connection, while AuthCrunch separately authorizes application access from a supported identity source. Passing the TLS check does not automatically create sub, email or application roles, enroll a local account, or bypass JWT/ACL validation.
If TLS terminates at another proxy, this Caddy instance does not receive the original client's TLS handshake. A forwarded certificate header needs a separately designed trusted-proxy and identity-mapping boundary; accepting a browser-supplied header is not certificate verification. Keep backend reachability and header normalization explicit.
For a working learning path, begin with your first protected app, then select a documented identity provider. For certificate-gated deployments, verify rejection with no certificate, an untrusted certificate and an otherwise authenticated user without the required app role. This page does not provide an unsupported x509 identity provider directive.
Agentic Prompts
Copy a prompt into your LLM to explore this topic. Each prompt prioritizes upstream repository guidance and code over this page, and asks for version-aware reasoning.
Separate certificate purposes
Help me understand X.509 and client-certificate boundaries.
Primary authorities (take precedence over website documentation):
https://github.com/greenpau/caddy-security/blob/main/AGENTS.md
https://github.com/greenpau/caddy-security/tree/main/.codex/skills
https://github.com/greenpau/go-authcrunch/blob/main/AGENTS.md
https://github.com/greenpau/go-authcrunch/tree/main/.codex/skills
Read each repository's root AGENTS.md first, then any scoped AGENTS.md that
applies to inspected paths. Read the relevant SKILL.md files and follow their
implementation and test references.
Relevant skills to locate: configuration-http-integrations,
configuration-crypto, configuration-identity-stores.
Secondary reference:
https://docs.authcrunch.com/docs/authenticate/x509/
If a source is inaccessible, ask me to paste its relevant text. Identify the
versions your answer applies to; main may be newer than my release. Resolve
disagreements using code and tests, and flag unverified claims. Use synthetic
credentials and redacted examples; explain proposed checks before any changes.
Compare server HTTPS, verified TLS client certificate, SAML signing
certificate, and portal JWT key. Explain the owning layer and authority each
establishes. Check the actual adapter before claiming an X.509
identity-provider directive exists.
Compare transport and identity
Help me understand X.509 and client-certificate boundaries.
Primary authorities (take precedence over website documentation):
https://github.com/greenpau/caddy-security/blob/main/AGENTS.md
https://github.com/greenpau/caddy-security/tree/main/.codex/skills
https://github.com/greenpau/go-authcrunch/blob/main/AGENTS.md
https://github.com/greenpau/go-authcrunch/tree/main/.codex/skills
Read each repository's root AGENTS.md first, then any scoped AGENTS.md that
applies to inspected paths. Read the relevant SKILL.md files and follow their
implementation and test references.
Relevant skills to locate: configuration-http-integrations,
configuration-crypto, configuration-identity-stores.
Secondary reference:
https://docs.authcrunch.com/docs/authenticate/x509/
If a source is inaccessible, ask me to paste its relevant text. Identify the
versions your answer applies to; main may be newer than my release. Resolve
disagreements using code and tests, and flag unverified claims. Use synthetic
credentials and redacted examples; explain proposed checks before any changes.
Draw a Caddy mTLS gate followed by supported AuthCrunch login/authorization.
Explain why passing a TLS check does not create a subject, local account, or
app role. Use the exact Caddy version’s official client_auth documentation for
transport controls.
Review a terminated TLS boundary
Help me understand X.509 and client-certificate boundaries.
Primary authorities (take precedence over website documentation):
https://github.com/greenpau/caddy-security/blob/main/AGENTS.md
https://github.com/greenpau/caddy-security/tree/main/.codex/skills
https://github.com/greenpau/go-authcrunch/blob/main/AGENTS.md
https://github.com/greenpau/go-authcrunch/tree/main/.codex/skills
Read each repository's root AGENTS.md first, then any scoped AGENTS.md that
applies to inspected paths. Read the relevant SKILL.md files and follow their
implementation and test references.
Relevant skills to locate: configuration-http-integrations,
configuration-crypto, configuration-identity-stores.
Secondary reference:
https://docs.authcrunch.com/docs/authenticate/x509/
If a source is inaccessible, ask me to paste its relevant text. Identify the
versions your answer applies to; main may be newer than my release. Resolve
disagreements using code and tests, and flag unverified claims. Use synthetic
credentials and redacted examples; explain proposed checks before any changes.
Ask where client TLS terminates and whether this instance sees the original
handshake. Compare verified local certificates with forwarded certificate
headers. Explain required trusted-proxy normalization and why a
browser-supplied header is not certificate verification.
Diagnose a certificate-gated request
Help me understand X.509 and client-certificate boundaries.
Primary authorities (take precedence over website documentation):
https://github.com/greenpau/caddy-security/blob/main/AGENTS.md
https://github.com/greenpau/caddy-security/tree/main/.codex/skills
https://github.com/greenpau/go-authcrunch/blob/main/AGENTS.md
https://github.com/greenpau/go-authcrunch/tree/main/.codex/skills
Read each repository's root AGENTS.md first, then any scoped AGENTS.md that
applies to inspected paths. Read the relevant SKILL.md files and follow their
implementation and test references.
Relevant skills to locate: configuration-http-integrations,
configuration-crypto, configuration-identity-stores.
Secondary reference:
https://docs.authcrunch.com/docs/authenticate/x509/
If a source is inaccessible, ask me to paste its relevant text. Identify the
versions your answer applies to; main may be newer than my release. Resolve
disagreements using code and tests, and flag unverified claims. Use synthetic
credentials and redacted examples; explain proposed checks before any changes.
Help me classify TLS rejection before HTTP, verified client lacking app
membership, wrong JWT signing key, and missing identity mapping. Ask for
public certificate metadata and redacted status. Do not invent a portal
certificate-login configuration to connect unsupported layers.
Plan combined-boundary tests
Help me understand X.509 and client-certificate boundaries.
Primary authorities (take precedence over website documentation):
https://github.com/greenpau/caddy-security/blob/main/AGENTS.md
https://github.com/greenpau/caddy-security/tree/main/.codex/skills
https://github.com/greenpau/go-authcrunch/blob/main/AGENTS.md
https://github.com/greenpau/go-authcrunch/tree/main/.codex/skills
Read each repository's root AGENTS.md first, then any scoped AGENTS.md that
applies to inspected paths. Read the relevant SKILL.md files and follow their
implementation and test references.
Relevant skills to locate: configuration-http-integrations,
configuration-crypto, configuration-identity-stores.
Secondary reference:
https://docs.authcrunch.com/docs/authenticate/x509/
If a source is inaccessible, ask me to paste its relevant text. Identify the
versions your answer applies to; main may be newer than my release. Resolve
disagreements using code and tests, and flag unverified claims. Use synthetic
credentials and redacted examples; explain proposed checks before any changes.
Design cases for no certificate, untrusted certificate, valid client with no
app identity, valid member, and valid nonmember. Identify whether each refusal
occurs at TLS or authorization. Explain what additional source evidence would
be needed for future certificate-to-user mapping.
Source Code References
Start with the code search, then follow the parser, runtime, and tests relevant
to this topic. These links target main; use GitHub's branch/tag selector to
compare them with your installed release.
- Search this topic in both repositories — searches topic-specific symbols and paths across both codebases.
- caddy-security: plugin_authn.go — mounts the portal in Caddy and delegates HTTP requests.
- caddy-security: plugin_authorization.go — preserves handled responses and applies authorized identity in the Caddy handler chain.
- caddy-security: caddyfile_identity_store.go — adapts local and LDAP store declarations.
- go-authcrunch: pkg/idp/provider.go — dispatches supported identity-provider kinds to their implementation.
- caddy-security: caddyfile_authz_crypto.go — delegates policy verification-key declarations to the keystore parser.