Api Rate Abuse with Mutual Tls

API rate abuse in Mutual TLS environments exploits the trust established through client certificate authentication to overwhelm backend services. Unlike traditional rate limiting that focuses on IP addresses or API keys, Mutual TLS rate abuse targets the cryptographic handshake and certificate validation process itself.

Attackers leverage the fact that Mutual TLS establishes a persistent connection state. Once a client certificate is validated, the server maintains trust for that specific certificate. This creates opportunities for abuse through certificate reuse and connection pooling attacks.

Common Mutual TLS rate abuse patterns include:

• Certificate Flooding: Attackers rotate through large numbers of valid client certificates, each appearing as a unique legitimate client to the server
• Connection Pool Exhaustion: Exploiting keep-alive connections to maintain numerous simultaneous sessions with valid certificates
• Handshake Amplification: Forcing the server to perform expensive cryptographic operations for each new certificate presented
• Certificate Chain Validation Abuse: Submitting certificates with complex chain structures that require extensive validation

The cryptographic overhead of Mutual TLS makes these attacks particularly effective. Each new connection requires certificate parsing, signature verification, and potentially OCSP/CRL checks. A single attacker with 1,000 valid certificates can easily overwhelm a server designed for 100 concurrent connections.

// Mutual TLS rate abuse example - certificate rotation attack
const tls = require('tls');
const fs = require('fs');

const certificates = [
  fs.readFileSync('cert1.pem'),
  fs.readFileSync('cert2.pem'),
  // ... hundreds more
];

const options = {
  ca: fs.readFileSync('ca.pem'),
  checkServerIdentity: () => null
};

async function attack() {
  const promises = certificates.map((cert, index) => {
    options.cert = cert;
    options.key = fs.readFileSync(`key${index + 1}.pem`);
    
    return new Promise((resolve) => {
      const socket = tls.connect(443, 'target-api.com', options, () => {
        socket.destroy();
        resolve();
      });
    });
  });
  
  await Promise.all(promises);
}

// This pattern exhausts server resources while appearing legitimate
attack().then(() => console.log('Certificate flood complete'));

The attack succeeds because each certificate represents a valid, trusted client. Traditional rate limiting mechanisms that track IP addresses or API keys fail to detect this abuse since each connection uses different credentials.

Detecting API rate abuse in Mutual TLS environments requires monitoring certificate usage patterns and connection characteristics that standard rate limiting misses.

Key detection signals include:

middleBrick's Mutual TLS-specific scanning identifies these abuse patterns through black-box testing. The scanner establishes connections using different client certificates and analyzes server responses for rate limiting behavior.

// Mutual TLS rate abuse detection logic
const tls = require('tls');

async function detectRateAbuse(caCert, targetUrl) {
  const certificates = [
    { cert: fs.readFileSync('client1.pem'), key: fs.readFileSync('key1.pem') },
    { cert: fs.readFileSync('client2.pem'), key: fs.readFileSync('key2.pem') },
    // Add more test certificates
  ];

  const results = [];

  for (const certInfo of certificates) {
    const start = Date.now();
    const responses = [];

    // Test multiple requests with same certificate
    for (let i = 0; i < 10; i++) {
      const response = await makeTlsRequest(certInfo, targetUrl);
      responses.push(response.status);
    }

    const duration = Date.now() - start;
    const avgResponseTime = duration / responses.length;

    results.push({
      certificate: certInfo.cert.toString('base64').substring(0, 20),
      responseStatuses: responses,
      avgResponseTime,
      requestsPerSecond: responses.length / (duration / 1000)
    });
  }

  return analyzeResults(results);
}

function analyzeResults(results) {
  const anomalies = [];

  results.forEach((result, index) => {
    if (result.requestsPerSecond > 5) {
      anomalies.push(`High request rate: ${result.requestsPerSecond} req/s`);
    }
    
    const statusDistribution = result.responseStatuses.reduce((acc, status) => {
      acc[status] = (acc[status] || 0) + 1;
      return acc;
    }, {});

    if (Object.keys(statusDistribution).length > 2) {
      anomalies.push(`Inconsistent status codes: ${JSON.stringify(statusDistribution)}`);
    }
  });

  return anomalies;
}

function makeTlsRequest(certInfo, url) {
  return new Promise((resolve) => {
    const options = {
      ca: fs.readFileSync('ca.pem'),
      cert: certInfo.cert,
      key: certInfo.key,
      checkServerIdentity: () => null
    };

    const socket = tls.connect(443, url, options, () => {
      socket.write('GET /api/endpoint HTTP/1.1\r\n\r\n');
    });

    let data = '';
    socket.on('data', (chunk) => data += chunk);
    socket.on('end', () => resolve(parseResponse(data)));
  });
}

function parseResponse(data) {
  const headers = data.split('\r\n\r\n')[0];
  const statusLine = headers.split('\r\n')[0];
  return { status: parseInt(statusLine.split(' ')[1]) };
}

// Run detection
detectRateAbuse().then(anomalies => {
  if (anomalies.length > 0) {
    console.log('Rate abuse detected:', anomalies);
  } else {
    console.log('No rate abuse detected');
  }
});

middleBrick automatically tests for these patterns by rotating through multiple client certificates and measuring server responses. The scanner identifies when servers fail to enforce rate limits at the certificate level, a common oversight in Mutual TLS implementations.

Remediating API rate abuse in Mutual TLS requires implementing certificate-aware rate limiting that goes beyond traditional IP-based or API key-based controls.

Effective remediation strategies include:

1. Certificate-Based Rate Limiting: Track requests per certificate rather than per IP
2. Connection Pool Limits: Cap concurrent connections per certificate
3. Handshake Rate Limiting: Limit new TLS handshakes per certificate per time window
4. Certificate Age Validation: Reject certificates with suspicious issuance patterns

Implementation using Node.js and mutual-tls-proxy:

const express = require('express');
const rateLimit = require('express-rate-limit');
const mutualTls = require('mutual-tls-proxy');

const app = express();

// Certificate-aware rate limiter
const certificateRateLimiter = rateLimit({
  keyGenerator: (req) => {
    // Extract certificate fingerprint from TLS connection
    const cert = req.socket.getPeerCertificate();
    if (cert.fingerprint) {
      return `cert:${cert.fingerprint}`;
    }
    return 'unknown-cert';
  },
  windowMs: 60 * 1000, // 1 minute
  max: 100, // limit each certificate to 100 requests per window
  message: 'Certificate rate limit exceeded'
});

// Connection pool limiter
const connectionPool = new Map();

function checkConnectionPool(req, res, next) {
  const cert = req.socket.getPeerCertificate();
  if (!cert.fingerprint) return next();

  const currentConnections = connectionPool.get(cert.fingerprint) || 0;
  
  if (currentConnections >= 50) {
    return res.status(429).json({
      error: 'Connection pool limit exceeded',
      limit: 50,
      current: currentConnections
    });
  }

  connectionPool.set(cert.fingerprint, currentConnections + 1);
  req.on('close', () => {
    connectionPool.set(cert.fingerprint, currentConnections - 1);
  });

  next();
}

// Handshake rate limiter
const handshakeLimiter = new Map();

function checkHandshakeRate(req, res, next) {
  const cert = req.socket.getPeerCertificate();
  if (!cert.fingerprint) return next();

  const now = Date.now();
  const recentHandshakes = handshakeLimiter.get(cert.fingerprint) || [];
  
  // Keep only handshakes from last 10 seconds
  const recent = recentHandshakes.filter(ts => now - ts < 10000);
  
  if (recent.length >= 20) {
    return res.status(429).json({
      error: 'Handshake rate limit exceeded',
      limit: 20,
      window: '10 seconds'
    });
  }

  recentHandshakes.push(now);
  handshakeLimiter.set(cert.fingerprint, recent);
  next();
}

// Apply middleware
app.use(checkConnectionPool);
app.use(checkHandshakeRate);
app.use('/api', certificateRateLimiter);

// API endpoint
app.get('/api/data', (req, res) => {
  res.json({ message: 'Authenticated and rate limited by certificate' });
});

// Certificate validation middleware
function validateCertificate(req, res, next) {
  const cert = req.socket.getPeerCertificate();
  
  if (!cert.fingerprint) {
    return res.status(401).json({ error: 'No client certificate provided' });
  }

  // Additional validation logic
  if (cert.issuerOrganization === 'Suspicious CA') {
    return res.status(403).json({ error: 'Certificate from untrusted issuer' });
  }

  next();
}

app.use(validateCertificate);

// Start server with mutual TLS
const server = mutualTls.createServer({
  key: fs.readFileSync('server-key.pem'),
  cert: fs.readFileSync('server-cert.pem'),
  ca: fs.readFileSync('ca.pem'),
  requestCert: true,
  rejectUnauthorized: true
}, app);

server.listen(443, () => {
  console.log('Mutual TLS server with rate limiting running on port 443');
});

// Certificate rotation detection
function detectCertificateRotation(req) {
  const cert = req.socket.getPeerCertificate();
  const now = Date.now();

  // Track certificate usage patterns
  const usage = usageTracker.get(cert.fingerprint) || { 
    firstSeen: now,
    lastSeen: now,
    ipAddresses: new Set(),
    requestCount: 0
  };

  usage.lastSeen = now;
  usage.ipAddresses.add(req.ip);
  usage.requestCount++;

  usageTracker.set(cert.fingerprint, usage);

  // Flag suspicious patterns
  if (usage.ipAddresses.size > 5 && usage.requestCount > 50) {
    console.warn('Potential certificate rotation detected:', {
      fingerprint: cert.fingerprint,
      ipCount: usage.ipAddresses.size,
      requests: usage.requestCount
    });
  }
}

app.use(detectCertificateRotation);

// Export monitoring data for analysis
function exportCertificateMetrics() {
  const metrics = [];
  
  usageTracker.forEach((usage, fingerprint) => {
    metrics.push({
      fingerprint,
      age: Date.now() - usage.firstSeen,
      ipCount: usage.ipAddresses.size,
      requestRate: usage.requestCount / ((Date.now() - usage.firstSeen) / 1000)
    });
  });

  return metrics;
}

// Export metrics endpoint
app.get('/api/metrics/certificate-usage', (req, res) => {
  res.json(exportCertificateMetrics());
});

This implementation provides comprehensive protection against Mutual TLS rate abuse by tracking certificate-specific metrics and enforcing limits at multiple levels of the TLS stack.