Forum Discussion
Extracting SSL Certificate Issuer from Server Side Connection
Well no. SERVER_DATA is a server-side event and typically triggers with a TCP::collect in the SERVER_CONNECTED event, which itself is triggered on a server side (node to BIG-IP) TCP handshake. The issue here is that you're looking for traffic coming from the BIG-IP, and aside for a few exceptions, there aren't iRule events for traffic leaving the BIG-IP. In other words, anything you do in SERVER_DATA is relative to traffic coming from the server, which in this case is the remote Internet host.
The only option you really have for capturing client-side traffic coming from the BIG-IP to the client is to layer a VIP in front of this VIP. This external layered VIP wouldn't do any SSL, just simple TCP pass-through.
when CLIENT_ACCEPTED {
virtual internal_vip
}
But it would see all of the TLS traffic coming from the SSLFWD configuration and could extract that information, albeit with TCP binary iRules processing.
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com