Forum Discussion
RiverFish
Altostratus
AltostratusGenerate SHA1 thumbprint of incoming SSL cert
Greetings! I have a request from a developer (below). I was hoping one of you could please help me come up with a solution?
---------------
The F5 needs to generate an SHA1 thumbprint of th...
hoolio
Cirrostratus
CirrostratusActually, you might want to remove the cert headers regardless of whether the client presented a cert for the SSL session to prevent a client from injecting their own headers.
when HTTP_REQUEST {
HTTP::header remove SSLClientCertSubject
HTTP::header remove ClientCertThumbprint
if { [SSL::cert count] > 0 } {
HTTP::header insert SSLClientCertSubject [X509::subject [SSL::cert 0]]
binary scan [sha1 [SSL::cert 0]] H* cert_hex
HTTP::header insert ClientCertThumbprint $cert_hex
}
}
Aaron
