Forum Discussion
CirrusBIG-IP ASM Cannot find client credentials for WS Security
Dear sirs, Kindly help on the following issue. We are configuring our BIG-IP ASM for WS Security. If we specify a client certificate that is self signed then things work fine. However it doesn't work when the client certificate is not self-signed i.e. when it is signed by either a well known root CA or by a private key that we installed on the BIG-IP ASM. The error obtained is: "Cannot find client credentials" The BIG-IP ASM version is 12.1.2 Does the ASM support a non-self-signed certificate for the web-service client in WS Security? In case yes please elaborate. Thanks and regards Mountazar
- boneyard
MVP
are you sure you have a client certificate? because usually client certificates aren't signed by a well known (i assume you mean public) root CA. also client certificates aren't signed by a key.
https://security.stackexchange.com/questions/80199/commercial-ca-for-your-client-certificates
Mountazar_Abou_Thank boneyard for your answer.
We tried to configure 3 types of values for the client certificate of SOAP WSS in F5-ASM:
- A self-signed client certificate => It worked fine (when a request was received).
- A certificate signed by the SOAP server private key => It did not work with "Cannot find client credentials" (when a request was received).
- An intermediate certificate signed by a root CA => It did not work with "Cannot find client credentials" (when a request was received with a WS-Signature signed with a key which certificate was signed by the configured intermediate).
Would you please clarify what do you meant by: "client certificates aren't signed by a key" ??? Regards,
- Mountazar_Abou_
Dear sirs,
When the client certificate is self-signed, things work smoothly.
However when the client certificate is signed by the private key configured as the WSS Server Certificate on F5 then things stop working.
In that case, when the SOAP request is received, the ASM rejects it with the below error:
Failed Web Services Security: Verification Error: Cannot find Client credentials
Any tried this before ?
Hannes_RappNimbostratus
Is this an implementation of LTM + ASM modules, or is this ASM standalone?
- Mountazar_Abou_
It is an LTM + ASM module
Chris_GrantEmployee
It is entirely possible that you are running into a known issue (ID 437076), but that cannot be verified with the information given. I would suggest that you use the self signed certificate if that works for your environment. If not, then I would suggest that you open a support case to verify if you are encountering this issue.
