Which type of OpenShift route configuration supports client certificate authentication?

The Passthrough route configuration is the only type that supports client certificate authentication handled by the end application. In this mode, the OpenShift router does not terminate the TLS connection. Instead, it passes the encrypted TCP traffic directly to the destination pod. This allows the application within the pod to manage the entire TLS handshake, which includes the process of requesting, receiving, and validating a client's certificate for mutual TLS (mTLS) authentication. The other route types terminate the TLS session at the router, preventing the backend application from participating in the client-side certificate exchange.

A. Edge: The router terminates the TLS connection from the client. The connection from the router to the pod is unencrypted, preventing the pod from performing client certificate authentication.

B. Re-encrypt: The router terminates the client's TLS session and initiates a new, separate TLS session to the pod, which prevents the application from directly authenticating the original client's certificate.

D. Re-encrypt with a custom certificate: This is a specific configuration of the re-encrypt route type and shares the same fundamental limitation; the router terminates the original TLS session.

---

1. Official OpenShift Container Platform 4.14 Documentation

"Networking > Configuring Routes > Secured routes":

Section: "Passthrough termination"

Content: "With a passthrough route

the Ingress Controller does not terminate TLS. The Ingress Controller passes encrypted traffic straight to the destination pod without providing TLS termination. Therefore

your application is responsible for serving certificates and terminating TLS." This confirms that the application handles the entire TLS process

which is necessary for client certificate authentication.

Reference: Red Hat OpenShift Container Platform Documentation

"Secured routes

" section on Passthrough termination.

2. IBM Cloud Docs

"Exposing apps with routes in Red Hat OpenShift on IBM Cloud":

Section: "Route security"

Content: "Passthrough: With a passthrough route

the TLS termination is handled by your app

not the Red Hat OpenShift router. Requests are not decrypted by the router before they are forwarded to your app." This document reinforces that the application is solely responsible for TLS termination in passthrough mode.

Reference: IBM Cloud Documentation

"Exposing apps with routes in Red Hat OpenShift on IBM Cloud

" section on Route security.