Haproxy ACL to compare values in the headers

Question

I use the Haproxy as the SSL termination to identify client side certificate. I want to check the CN value in the client certificate if it matches a header value sent by the client. Is there a way to set ACL if the CN value in the certificate does not match the value in the header?

Something like:

http-request set-header X-SSL-Client-CN     %{+Q}[ssl_c_s_dn(cn)]
acl id_not_match hdr(client-id) -m hdr(X-SSL-Client-CN)

Answer 1

A Sample configuration to check CN and allow authentication based on a list:

frontend www-https
   ....
   http-request set-header X-SSL-Client-CN             %{+Q}[ssl_c_s_dn(cn)]
   use_backend www-backend
backend www-backend
   acl allow_users req.fhdr(X-SSL-Client-CN) -m str -f /etc/haproxy/ssl/userslist
   http-request deny if !allow_users
   ....
   server www-1 <ip>:<port> check
   server www-2 <ip>:<port> check