Forum Discussion
gym1
Nimbostratus
Nimbostratus(How) can I get two client certificates in one APM session?
I have a customer with iPads that need to authenticate to APM with a user certificate. This has been working fine, but there is also now need to read a field from a per-device certificate on each iPad and make use of this within the access policy. The two certificates are issued by different authorities.
Maybe I am wrong, but it seems impossible to change the client SSL profile by renegotiating SSL during the session, so as to let me check the user cert and then the device cert.
Does anyone know of a way?
TMOS V16.1
- Lucas_Thompson
Employee
You should be able to simply use multi-domain SSO (it allows multiple hostnames to share the same APM session) with two DNS names and use two vips (each with a separate "advertised CAs" setting in the clientssl profile so hopefully the client doesn't get a popup to choose the cert), attached to the same access profile, and collect the second certificate once the session is established inside of a per-request policy.
Testing and setting this up would be somewhat complex.
spalandeNacreous
In APM flow you can add the action to get the device certificate as well. Please check below article and let us know how the testing goes.
gym1Thanks for the suggestion. I guess I should have mentioned that I had considered the device certificate policy item as a possibility, but it is only supported on Windows and Mac, whereas the clients here are iPads. It requires knowledge of the certificate store name, which is hidden from me, and as that reference says, need the Edge client. I'm trying to avoid the use of Edge, because these devices are already using a VPN client from another vendor. We know from experience that the two conflict.
So I have an unusual set of conditions.
I'm now considering use of an external logon page hosted on another virtual on the F5 (as an iRule I hope), That would have a client SSL profile that captures the other client certificate, then parses it for the field I need, and somehow returns that to the original policy. Then somehow I hope to parse that response and use that field value.
I say "somehow" because frankly the external logon page feature does not seem well documented. It's not at all clear what the policy expects to receive back from the external logon page, nor how the response can be used.
