TLS mutual authentication

[foxfire881]

it's dangerous to deploy vaultwarden on internet, although it supports TLS, it is unilateral authentication，everyone could click 'continue' button in browser to pass the https errors to attack vaultwarden(such as brute force attack).

if vaultwarden could support TLS mutual authentication, then only the one who has the client certificate in browser or other clients could access vaultwarden on internet, it will be security more and more.

so, is there a plan to support TLS mutual authentication?

[BlackDex]

I do not think we will implement this for several reasons.

1. The desktop and mobile clients are not supporting this.
2. Rocket does seem to support this, but I'm not sure how and if this will work correctly via a reverse proxy.

If you still want something like this, i suggest to use a reverse proxy which has this functionality, like Caddy, Nginx, Haproxy, traefik etc..
But, remember that the clients probably will not work correctly.

[foxfire881]

I do not think we will implement this for several reasons.

1. The desktop and mobile clients are not supporting this.
2. Rocket does seem to support this, but I'm not sure how and if this will work correctly via a reverse proxy.

If you still want something like this, i suggest to use a reverse proxy which has this functionality, like Caddy, Nginx, Haproxy, traefik etc.. But, remember that the clients probably will not work correctly.

good idea~ i will try to deploy a https reverse proxy in front of vaultwarden with nginx to implements this feature.

[Gandulf78]

It is also possible with Cloudflare. Unfortunately the iOS client doesn't accept mTLS (see bitwarden/mobile#582)

[gtaws]

it's dangerous to deploy vaultwarden on internet, although it supports TLS, it is unilateral authentication，everyone could click 'continue' button in browser to pass the https errors to attack vaultwarden(such as brute force attack).

if vaultwarden could support TLS mutual authentication, then only the one who has the client certificate in browser or other clients could access vaultwarden on internet, it will be security more and more.

so, is there a plan to support TLS mutual authentication?

I was looking into this myself, but for very different reasons. I agree with @BlackDex - if this breaks the clients, then there's no point in implementing this. You're best bet is to use the owasp/modsecurity-crs;nginx image to front vaultwarden so you can have WAF protecting your public facing install. Or just keep your vaultwarden behind a VPN.

[Gandulf78]

One solution to improve security could be to use VPN on demand (on iOS). It is possible with Tailscale though not perfect.
See tailscale/tailscale#10211

[johanneswk]

@gtaws I think that there would actually be a point in implementing it. I'm running a simple Azure Container App (ACA) without VNET integration. A custom domain is used via Cloudflare, however the Vaultwarden installation is also still available via the standard https://*.azurecontainerapps.io. If we were to have mTLS we could do something similar like this: Authenticated Origin Pulls

This would help securing Vaultwarden installations behind Cloudflare, by making sure only Cloudflare can access the Vaultwarden instance before making it accessible to the internet.

[BlackDex]

I do not see that we will add this to Vaultwarden it self. Main reason is, most clients do not support this feature and only cause issues when people try to connect and fail.

Also, there are much better tools out there to handle this in a much more safer way by using the right reverse proxy tools.
Also, most of the time you are probably not running just Vaultwarden in these cases and have multiple tools for which you probably want to restrict access in the same way. Then it is much better, and safer, to handle this all via that one tool.

[gtaws]

@gtaws I think that there would actually be a point in implementing it. I'm running a simple Azure Container App (ACA) without VNET integration. A custom domain is used via Cloudflare, however the Vaultwarden installation is also still available via the standard https://*.azurecontainerapps.io. If we were to have mTLS we could do something similar like this: Authenticated Origin Pulls

This would help securing Vaultwarden installations behind Cloudflare, by making sure only Cloudflare can access the Vaultwarden instance before making it accessible to the internet.

Honestly, I don't think this is a good use of the authors' time here. If you really want mTLS support, just run nginx in front of Vaultwarden in a Docker compose stack and don't expose Vaultwarden directly. I do that today, it takes only a few moments. I do it mainly to prevent anyone who invades the host from being able to access Vaulwarden through the open port. But afterwards I do something similar to you, but on host as well instead of CDN - I put owasp/modsecurity-crs;nginx in front of the whole stack connected to the host network which forwards to this backend nginx stack that requires mTLS to connect. That's the only process that's exposed to internet now. You can do the same. Also, as @BlackDex said, you most likely need additional tools to secure the installations in addition to a WAF. Many tools support nginx and CRS, few support Vaultwarden logs.