For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

mlanghorst's avatar
mlanghorst
Icon for Nimbostratus rankNimbostratus
Apr 04, 2023

APM On-Demand cert auth failing for curl command line client

Had a requirement for a site that was moving from Apache with ACL's over to F5 in front of an Apache instance, that only requires a user certificate authentication for a specific /uri.  For the SSL p...
application delivery
Nikoolayy1's avatar
Nikoolayy1
Icon for MVP rankMVP
Apr 10, 2023

Also you may try API protection profile as I think you are getting redirection based on APM login page or something like that. You can't use client cert but oauth access token is something similar as this is only what you have:

 

https://clouddocs.f5.com/training/community/access-solutions/solution13/guide/guide.html

 

https://www.youtube.com/watch?v=-2ndGH9Dp1Q

 

The oauth server can still accept the client ssl cert before giving the token:

 

https://techdocs.f5.com/en-us/bigip-14-1-0/big-ip-access-policy-manager-oauth-configuration-14-1-0/using-apm-as-an-oauth-2-server.html
 
 
 
 
 
 

 

-----------------

When configuring On-Demand certification authentication in a

per-request policy

, avoid having any other agent before the On-Demand Cert Auth agent if the client SSL profile on the virtual server has the

Client Certificate

field set to

ignore

. This configuration makes the per-request policy re-execute the subroutine when it reaches the On-Demand Cert Auth agent. This can cause the per-request policy to go to the unexpected branch on each agent located before On-Demand Cert Auth agent.