Forum Discussion

Akhtar_109015's avatar
Akhtar_109015
Icon for Nimbostratus rankNimbostratus
Dec 08, 2013

Client authentication prompts (SSL profiles)

Hello all,

 

I was wondering if someone facing below issue when client authentication is implemented with SSL profiles. Every thing works fine after below prompts.

 

User certificate prompt appears 4 times in chrome, 2 times in IE and once in Firefox.

 

I am wondering if this has something to do with the browser behaviour ?

 

Regards,

 

Akhtar

 

deployment
design
ssl client authentication
  • Emad's avatar
    Emad
    Icon for Cirrostratus rankCirrostratus
    Dec 08, 2013

    what is the error warning in prompt. Also are u using self-signed certificate. ?

     

  • Akhtar_109015's avatar
    Akhtar_109015
    Icon for Nimbostratus rankNimbostratus
    Dec 14, 2013

    Hi Kevin,

     

    Following is the client SSL profile config and irule applied to the virtual server. Will wait for your feedback on the cause of these repeated prompts.

     

    ![Image Text](/Portals/0/Users/215/15/109015/gportal client authentication.jpg)

     

    ![Image Text](/Portals/0/Users/215/15/109015/irule gportal insert cert subject 1.jpg)

     

    ![Image Text](/Portals/0/Users/215/15/109015/irule gportal uri rewrite_updated.jpg)

     

    Regards,

     

    Akhtar

     

  • achrich's avatar
    achrich
    Icon for Nimbostratus rankNimbostratus
    Jul 24, 2014

    Hi,

     

    I have a similar issue using the Edge Client software. When the user logs in the the certificate is requested twice.

     

    Is their anyway to prefix the software to always use the relevant certificate ?

     

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Jul 24, 2014

    I have a similar issue using the Edge Client software. When the user logs in the the certificate is requested twice.

     

    Do you have client certificate request/require enabled in the client SSL profile, the APM On-Demand Cert Auth agent, or both?

     

    Is their anyway to prefix the software to always use the relevant certificate ?

     

    No, there's no way to tell the client which certificate to use. You can suggest which certificate to use, if there are multiple that can be used, by sending a CA "root hint" in the SSL handshake (apply a filtered CA bundle in the Advertised CA list of the client SSL profile).

     

  • achrich's avatar
    achrich
    Icon for Nimbostratus rankNimbostratus
    Jul 24, 2014

    Hi,

     

    We currently have clientssl profile set to "require" - however I`ve tested it with "request" with similar results.

     

    Problem is we have 2 certificates per users - one used for verification and one for email encryption.

     

    Both of these come via the same CA which we advertise.

     

    Its not a massive issue but I expect some noise as previous VPN client software was pre-set.

     

    Thanks.