F5 is upgrading its customer support chat feature on My.F5.com. Chat support will be unavailable from 6am-10am PST on 1/20/26. Refer to K000159584 for details.

Forum Discussion

Mr_Moody's avatar
Mr_Moody
Icon for Nimbostratus rankNimbostratus
Oct 16, 2020

custom error page for missing client authentication certificate

I have a working IRule below that requests a client certificate based on uri and data group list. In the event the client does not provide a valid cert I would like to redirect the user to custom ht...
iRules
LTM
security
Yoann_Le_Corvi1's avatar
Yoann_Le_Corvi1
Icon for Cumulonimbus rankCumulonimbus
Oct 17, 2020

Hi

I did not test it, but something like this should help :

when CLIENT_ACCEPTED {
        set clientCertPresent 0
}
 
 
when CLIENTSSL_CLIENTCERT {
        set subject_dn [X509::subject [SSL::cert 0]]
        if { $subject_dn != "" }{
                set clientCertPresent 1
        }
}
 
 
when HTTP_REQUEST {
 
  if { [HTTP::uri] starts_with "/uri1" || [HTTP::uri] starts_with "/uri2"} {
 
   if {not [matchclass [IP::remote_addr] equals NOCERT_IP_LIST] && $clientCertPresent equals "0" } {
 
    SSL::session invalidate
 
    SSL::authenticate always
 
    SSL::authenticate depth 9
 
    SSL::cert mode require
 
    set cmd "SSL::profile /Common/require_clientssl"
 
    eval $cmd
 
    SSL::renegotiate
 
    event disable all
 
  } else {
  
    HTTP::redirect "https://my.error.page.com/error.htm"
    }
  }
 
}
 
}

hope this helps.

Yoann

Mr_Moody's avatar
Mr_Moody
Icon for Nimbostratus rankNimbostratus
Oct 19, 2020

Thank you for the reply. Unfortunately I was not able to make this rule work for me. Perhaps I can elaborate on my goals. We can ignore the URI condition as it's not the most important part.

 

First: if IP is on NO_CERT_IP_LIST then allow access without client certs (using ignore_cs_ssl_profie?)

 

Second: All other IP's will require client certs (require_cs_ssl_profile?). if there are any ssl errors at this stage then the client should be redirected to an html error page. This would include wrong cert or no cert errors.

 

Thank you!

 

In the VS I have an ssl profile assigned and set to ignore client certs as the default. The IRule I have working now selects a different ssl profile that requires client certs based on the condition of the data group and URI. This works as intended except I am not able to redirect to custom error page.