For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

gpoverland's avatar
gpoverland
Icon for Nimbostratus rankNimbostratus
May 09, 2019

Desired Outcome - OCSP Prompt displays E-Mail Cert Only

I have a situation where my physical device carries three client certs: 1 that contains persona information, 1 that contains email information, and 1 that contains general information. Each Client cert is issued by a separate CA. CA 1. is MyID-20, CA2. is MyEMAIL-14, and CA3 is MyInfo-30.. I have built a CA Bundle and typically used it in my OCSP Responder configuration. I have a client SSL cert associate with my F5 LTM Virtual Server, where I have the hostname for that URL included the cert I present as well as the CA I have identified. This solution works fine, but the client is presented with an option to select which of the 3 client certs to use when authenticating against my application. I would like to force the client to present only the MyEMAIL-14 (chain) cert, so I need to limit their options. I thought I could do this from the serverside by building a new bundle of just the E-Mail certs, and applying it to the OCSP responder/auth profile associated with the Virtual. Now I am second guessing (haven't tried this in a lab yet). Has anyone faced this and/or have ideas on how to accomplish this?

 

THanks,