Forum Discussion

Jean_Mamène's avatar
Jun 26, 2023

double authentication with check CN serial number and certificate authority


We have version 16 of BIG-IP LTM.
We have a virtual server on which several urls of the same domain are defined and which sends requests to the same pool of servers. On this virtual server and for a specific URL, we need double certificate authentication. Only a certificate should authorize the connection to the server pool. We want to check that the Common Name, Serial Number and Certificate Authority are correct to identify the certificate.

The virtual server "" has the following URLs defined:
- with double authentication

Client certificate:
- CommonName =
- serial_number = 0123456789abcdef
- certificate authority = MyCertificateAuthority

I wanted to know if it was possible to set the URL with double authentication on the same vhost as the other URLs or if it should be set on a new virtual server.
In the 2 cases, what configuration should be set up to solve this problem?

Best regards.

6 Replies

  • Hello,

    I'm back to give you some news.
    We have created a specific vhost for testing purposes and so as not to impact the other services hosted on the shared virtual servers.
    The irule for verifying the CN and serial number of the certificate is up and running (validated by the customer).
    We'll now look at configuring the SSL client profile.

    Best regards.

    • CA_Valli's avatar
      Icon for MVP rankMVP

      Thanks for the feedback! Let us know if we can help you further in configuring this 😉

    • LiefZimmerman's avatar
      Icon for Admin rankAdmin


      If your original issue was resolved please choose Accept As Solution on one (or more) replies.

      This helps other members find answers more quickly and confirms the efforts of those who helped.
      Thanks for being part of our community.

  • Hello,Thank you for your feedback.
    Daniel_Wolf, I'll be more careful next time about the vocabulary used.
    I'm currently running tests and I'll get back to you to confirm that it's working properly.

  • Hello Jean_Mamène ,

    It should be possible to have this work on the same VIP, theorically.
    To configure client authentication, You need to build a clientSSL profile and configure it for the specific SNI "", and enable client authentication with "require" setting on this same profile. You should import the trusted CA that singed this certificate on BIG-IP

    Next step is verifying client-certificate informations (SN, etc.) at authentication time. This can be achieved via iRule.
    You can get ideas from this code here, and tune it to check/match the requirements of your deployment.