HTTP 400 Bad Request / SOAP Fault When SSL Inspection is Enabled on mTLS API Endpoints

Products

• VIP Service

Issue/Introduction

When disabling an SSL Inspection Bypass rule (enabling active SSL/TLS decryption and proxying), connections to VIP Service APIs return a SOAP fault or HTTP status 400 Bad Request.

Cause

When SSL inspection is active, the proxy or firewall acts as a Man-in-the-Middle (MitM) device. It terminates the incoming TLS session from the client and establishes a new, separate TLS session to the destination API server.

If the backend API relies on Mutual TLS (mTLS) certificate authentication, the connection fails with an HTTP 400 error due to one of the following validation failures:

• Loss of Client Certificate During TLS Termination: The inspection proxy cannot present the original client certificate to the destination API server because it does not possess the client's private key. The backend server rejects the unauthenticated connection.

• Missing or Misconfigured HTTP Header Forwarding: If the proxy attempts to pass client certificate data via custom HTTP headers (e.g., X-Client-Cert), the request will fail if the proxy policy is not configured to extract/inject these headers, or if the backend API strictly requires mTLS at the transport layer (TLS layer) rather than via HTTP headers.

• Failed TLS Renegotiation: If the API server requests client certificates during a post-handshake TLS renegotiation phase, standard MitM proxies typically drop or reject these renegotiation frames.

Resolution

To resolve the HTTP 400 validation error on mTLS-secured endpoints, apply one of the following configurations on your network proxy or NGFW:

Option 1: Re-enable SSL Inspection Bypass (Recommended) Add the target API domain names or IP addresses to your proxy's SSL Inspection Bypass / Exclusion List (configured to SSL Pass-Through or SSL Tunneling mode).

Note: End-to-end cryptographic trust in mTLS requires direct communication between the client and the server. Bypassing decryption preserves the client certificate exchange at the transport layer.

Option 2: Configure Client Certificate Header Re-Injection If your organization's security policy prohibits SSL inspection exemptions:

1. Verify whether the target API accepts client certificate data forwarded in HTTP request headers.

2. Configure your inspection proxy policy to terminate mTLS on the client-facing side, extract the client certificate, and inject the certificate metadata into the HTTP header format expected by the backend service.