For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Skuba_85554's avatar
Skuba_85554
Icon for Nimbostratus rankNimbostratus
Aug 11, 2009

bypassing client authentication

i've got a virtual server listening on 443 which uses both a certificate for SSL and also requires client authentication. this works fine     i've now been informed of another set of users ...
config
design
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Aug 14, 2009
I think you could start with something like this: 

 
 when CLIENTSSL_HANDSHAKE { 
   if { [SSL::cert count] > 0 } { 
     HTTP::release 
   } 
 } 
  
 when HTTP_REQUEST { 
   if {not ([HTTP::uri] starts_with "/abc/") } { 
     if {[SSL::cert count] == 0} { 
       HTTP::collect 
       SSL::authenticate always 
       SSL::authenticate depth 9 
       SSL::cert mode require 
       SSL::renegotiate 
     } 
   } 
 }

Aaron