I've been looking into client certificate authentication a bit lately on behalf of work, and I was wondering if this is something you've had a look into at any point. From my end, it looks like it shouldn't need any major implementation in authentik but rather just a stage like the webauthn/totp-stages, with some slight modifications to the go proxy.

I think there would be a couple of benefits to this long-term:

• Certificate authentication would enable certain users and organizations to use their countries eID and company-specific electronic IDs for authentication within authentik.
• Would also enable certain types of smart card authentication (depending on the users existing infrastructure)
• Can also be utilised for API authentication with heightened security

The major part of this as it stands would be an implementation into the go proxy, since that's the part currently handling certificate authentication. I don't have a lot of experience with go as of right now, but if this is something that would appeal to a broader audience I'd be happy to look into a couple of PRs on the subject.

I've managed to run some tests by integrating it into gunicorn separately, but since that server doesn't handle the TLS parts of authentik I don't think that's the way forward.

A basic implementation of this would be:

1. Go proxy asks for client certificate when accessing certain flows (by URI? or does the proxy have any awareness of states in the application?)
2. The proxy sets a header (e.g. X-Client-Cert-CN, X-Client-Cert-Issuer, X-Client-Cert-CA-Cert) to the authentik flow
3. Authentik verifies the certificate against a certificate currently in storage
4. Uses the certificate CN (configurable mapping) to map the authentication to a user, either as single-factor or multi-factor after sign-on with another stage.