Forum Discussion

igorzhuk's avatar
igorzhuk
Icon for Altostratus rankAltostratus
Apr 06, 2021

Client SSL cert Move Traffic To CDN -

hi all, i move the app to CDN before the CDN the BIGIP will check the client SSL cert and base on URI allow to access to the site, (some of uri work without the client ssl, and some uris work only i...
application delivery
cloud
iRules
LTM
spalande's avatar
spalande
Icon for Nacreous rankNacreous
Apr 06, 2021

Yes. You would need to build the data group of all valid client certificates.when BIGIP receives the ​details of the certificate it would match against the known records and take action if either allow or reject. This needs to be done using an iRule.

​

Serial number is unique per certificate so if someone try to spoof the certificate also SubjectDN (common name) can be the same but Serial Number won't match.

​

Following are the unique values of the certificate.

​

  • SubjectDN and Issuer CA (combination)
  • Serial Number
  • Thumbprint

​

​