Help with X509 auth on jetty behind apache2

[Francesco Malvezzi]

Hi all,

I need help to figure out why jetty-9.3.15 is not receiving the X509
cert info from apache2 while those info are displayed on a cgi-bin test
page (if only apache2 is concerned).

My apache2 virtual host is:

[...]
<Location /idp/Authn/X509>
    SSLVerifyClient require
    SSLVerifyDepth 5
    SSLOptions -StdEnvVars +ExportCertData
    # I suspect next directive is useless
    RequestHeader set SSL_CLIENT_CERT "%{SSL_CLIENT_CERT}s"
</Location>

RequestHeader set X-Forwarded-Proto "https" env=HTTPS
ProxyPass /idp http://localhost:8080/idp connectiontimeout=5 timeout=15
RequestHeader set REMOTE-USER %{REMOTE_USER}s
[...]

I didn't modify anything on jetty because, if I'm not mistaken,
org.eclipse.jetty.server.SecureRequestCustomizer customization is
applied by default on httpConfig.

But actually I think I missed something very basic,

thank you,

Francesco

PS: idp error is: ERROR
[net.shibboleth.idp.authn.impl.X509AuthServlet:113] - No X.509
Certificates found in request
User is requested to enter the PIN and to choose cert from smartcard, so
I really believe either apache2 is not forwarding cert info, or jetty
not accepting.