Forum Discussion
AltostratusClient cert auth, more than advertised CA filtering?
EmployeeQuick answer is no, but also that's it's not something that the F5 can control anyway. A server can hint to the client on which certs it can select from, which is what the Advertised list does, but ultimately it's up to the client to perform said filter, and per the RFC it's only based on issuer information.
Might I inquire, the CA that issues two of the certs on the smart card, are they both identity certs (keyUsage contains "Client Authentication"), or is one of these an (email) encryption certificate?
AltostratusThey are both "identity certs", the old cert has a Key usage of Digital Signature, Non-Repudiation and no Enhanced Key usage.
The new cert that has been mandated for authentication is Digital Signature with Enhanced Key usage of Smart Card Login, Client Authentication.
There has been a mandate for web application owners to only be able to authenticate using this new certificate by early next year, and in some of the documentation it can be construed that you cannot allow the other certificates that have been issued by the same CAs.
And of course with the contact info that they give you, no one responds.
