For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

WCP_183386's avatar
WCP_183386
Icon for Nimbostratus rankNimbostratus
Jan 20, 2015

F5 to Jboss

I'd like to use F5 to loadbalance over some Jboss servers (no httpds), also terminating mutually-authenticated SSL at the F5.   How do I get the client's certificate subject name into Jboss to ch...
application delivery
deployment
LTM
security
WCP_183386's avatar
WCP_183386
Icon for Nimbostratus rankNimbostratus
Jan 20, 2015

I figured F5 would provide the validation of the certificate against the trust store, but not subject name checking. Can F5 check that the certificate actually names a subject that we specify as a valid user? e,g, CN=somename.we.allow ??

 

WCP_183386's avatar
WCP_183386
Icon for Nimbostratus rankNimbostratus
Jan 20, 2015
Well, the fact that a certificate is valid against the truststore (i.e. issued by a trusted authority) isn't enough. It has to be valid/trusted AND reference a subject entity that we have agreed to allow into the system (DN references this entity by name somehow). So, I'm wondering if F5 can do both of these things. Obviously it can check validity, but can it then also check subject. Spurious subjects wouldn't be a problem as they couldn't be asserted on a trusted certificate (i.e. one where we trust the issuer to only provide legit identities).