Forum Discussion

Cirrus

Jul 10, 2019

Extract SAN from Client SSL Certificate & Insert into HTTP Header

Hi folks,

I'm working with some co-workers to setup some Slack.com forwarding in our environment. Mutual TLS and the insertion of the SAN from the client certificate into a HTTP header is a requirement. Can anyone help me come up with an iRule or LTM Policy to extract the SAN/CN from the client SSl cert and insert it as a HTTP header? Here's some additional info from Slack:

Configure your TLS-terminating server to request client certificates. Your server should accept client certificates issued by DigiCert SHA2 Secure Server CA, an intermediate CA under DigiCert Global Root CA. These CAs are included in many standard CA certificate bundles.

1- Extract either of the following fields in the certificate.
Subject Alternative Name: DNS:platform-tls-client.slack.com. By RFC 6125, this is the recommended field to extract.
or Subject Common Name: platform-tls-client.slack.com.

2- Inject the extracted domain into a header, and forward the request to your application server. Here's an example header you might add to the request: X-Client-Certificate-SAN: platform-tls-client.slack.com. Whatever you choose to call your header, check to make sure this header hasn't already been added to the request. Your upstream application server must know that the header was added by your TLS-terminating server as part of the Mutual TLS process.

When I apply that iRule my test cert works. Not sure why your environment is different. Here's an alternate iRule you could try.

when HTTP_REQUEST {
  if {[SSL::cert 0] ne ""}{
    set tmpcn [X509::subject [SSL::cert 0]]
    set cn [findstr $tmpcn "CN=" 3]
    HTTP::header replace X-Client-Certificate-SAN $cn
    
  } else {
    HTTP::header remove X-Client-Certificate-SAN
  }
}

My test results.

 curl -k --cert ./platform-tls-client.slack.com.crt --key ./platform-tls-client.slack.com.key https://192.168.1.200:8443/headers.json
{"User-Agent":"curl/7.29.0","Host":"192.168.1.200:8443","Accept":"*/*","X-Client-Certificate-SAN":"platform-tls-client.slack.com"}

Here's what my config looks like.

ltm virtual test_vs {
    creation-time 2019-08-27:10:03:53
    destination 192.168.1.200:pcsync-https
    ip-protocol tcp
    last-modified-time 2019-08-27:10:20:58
    mask 255.255.255.255
    pool slack_pool
    profiles {
        http { }
        mtls_clientssl {
            context clientside
        }
        tcp { }
    }
    rules {
        slack2
    }
    source 0.0.0.0/0
    source-address-translation {
        type automap
    }
    translate-address enabled
    translate-port enabled
    vs-index 3
}
 
ltm profile client-ssl mtls_clientssl {
    app-service none
    authenticate-depth 0
    ca-file f5ca
    cert-key-chain {
        default {
            cert default.crt
            key default.key
        }
    }
    defaults-from clientssl
    inherit-ca-certkeychain true
    inherit-certkeychain true
    peer-cert-mode require
}
 
ltm rule slack2 {
when HTTP_REQUEST {
  if {[SSL::cert 0] ne ""}{
    # extract SAN
    set santemp [findstr [X509::extensions [SSL::cert 0]] "Subject Alternative Name" 32 ","]
    # remove DNS: prefix
    set san [findstr $santemp "DNS" 4]
    # insert X-Client-Certificate-SAN header
    HTTP::header replace X-Client-Certificate-SAN $san
 
  } else {
    HTTP::header remove X-Client-Certificate-SAN
  }
}
}

Eric_Chen

Employee

Jul 10, 2019

I created the following codeshare example that does what is required to generate the X-Client-Certificate-SAN: https://devcentral.f5.com/s/articles/Slack-Mutual-TLS-Recipe-Adding-X-Client-Certificate-SAN-header-from-client-certificate

alanjohnson7467

Cirrus

Aug 27, 2019

Hi Eric,

Our application owners have finally gotten around to testing this and we are running into a slight problem. The header is getting inserted, but is including this full value which seems to be breaking things:

platform-tls-client.slack.com X509v3 Key Usage: critical Digital Signature

...do have any suggestions on how to remove the extra info in the value?

Thanks!

Eric_Chen

Employee

Aug 27, 2019

Can you send me a sample of your iRule? It is "weird" that it is grabbing that extra information. If you have a way to dump a copy of the Slack cert it would help. Here's my "test" cert that I have been using.

and my test CA

alanjohnson7467
Cirrus
Jul 10, 2019
Thank you so much Eric! I really appreciate it.

Best wishes,
Alan

Recent Discussions

Under Attack? F5 Will Help You.
Contacting F5 Support?

DevCentral Quicklinks

* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com

Discover DevCentral Connects

* Podcasts
* Social Channels
* Video Streaming

Forum Discussion

Extract SAN from Client SSL Certificate & Insert into HTTP Header

Recent Discussions

Client SSL Profile set to Require Client Certificate breaks RDP in APM

TS Declarations for DNS

APM file and registry key date check 8 days old

SSL bridging without SSL proxy forward

Should config via cli rather than gui?

Related Content

Re: Management Certificate

ASM vs to APM vs and client certificates

Client ssl certification bulk installation

Certifications for security professionals

Certificate Expiry Email alert configuration

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS