Client SSL Cert Irule

Hi,

 

 

I don't understand why you use HTTP::release in your CLIENT_SSL event.

 

 

can't you do this with this code? :

 

 

when CLIENTSSL_CLIENTCERT {
log local0. "start CLIENTSSL_CLIENTCERT"
set the_cert [SSL::cert 0]
set pkiSubject [X509::subject $the_cert]
set pkiIssuer [X509::issuer $the_cert]
log local0. "end CLIENTSSL_CLIENTCERT"
}
when HTTP_REQUEST {
  log local0. "start HTTP_REQUEST, uri is [HTTP::uri]"
  if { [HTTP::uri] starts_with "/SLFCSSOCollector/ssl/" } {
     log local0. "URI /SLFCSSOCollector/ssl/ detected!"
     if { [SSL::cert count] == 0} {
        log local0. "no certificate found... force SSL"
        SSL::cert mode require
        SSL::renegotiate
        log local0. "end HTTP_REQUEST"
      }
   } else {
    log local0. "certificate found!"
    set the_cert [SSL::cert 0]
    set pkiSubject [X509::subject $the_cert]
    set pkiIssuer [X509::issuer $the_cert]
    HTTP::header insert CLIENTSSL_Status [SSL::verify_result]
    HTTP::header insert CLIENTSSL_StatusString [X509::verify_cert_error_string [SSL::verify_result]]
    HTTP::header insert CLIENTSSL_CN $pkiSubject
    HTTP::header insert CLIENTSSL_SSLIssuer $pkiIssuer
    HTTP::header insert CLIENTSSL_SSLClientCertSN [X509::serial_number $the_cert]
    HTTP::header insert CLIENTSSL_Cert [b64encode $the_cert]
   }
}

 

 

If you test this code, please show us the output of /var/log/ltm so that we can trace what is happening