Forum Discussion
AltocumulusDenying SSL client untrusted CERT connections
Is there a way to deny a client request connecting to https when it gets the untrusted cert error? I want to roll out a private trusted root certificate along with an intermediate chain on internal tablet devices but host an external website to only be used by them. So if anyone comes in not trusting the SSL certificate presented by the F5 VIP can we reject that client. What would the irule look like?
Yann_DesmarestCirrus
Hi,
You can implement HSTS header using irule, LTM policy or simply using by checking the option in the HTTP profile. Errored SSL connections to your server will be rejected by the browser.
You have also an option to provide Public Key Pinning. This feature control that the certificate you see is the same that the server provides. It disallow SSL interception / MiTM.
Regards
Yann
- Kevin_Stewart
Employee
The simple answer is no though. You cannot control the behavior of the client. HSTS provides that the client always talks to the server over HTTPS, and certificate pinning only ensures that there's no MITM.
