Mutual TLS may be configured in passthrough mode, with a trust store that contains untrusted certificate authorities, or without revocation checking. Clients that present no certificate or a revoked one are then forwarded to backend targets as if authenticated, compromising the confidentiality and integrity of the resources behind the load balancer.
Client Certificate Validation Is Bypassed
CCC.LB.TH10
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.LB.CP26 | Mutual TLS Client Authentication | The service may be configured to require and validate client certificates during the TLS handshake, rejecting connections from clients that do not present a certificate issued by a trusted authority. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.LB.CN13 | Validate Client Certificates | Ensure that mutual TLS on a listener rejects clients that do not present a valid certificate from a trusted authority. |