how to specify a ca_bundle in an irule

Hi Stephen,

 

 

I think there are two relevant configuration options for the client cert CA bundle. The first is the trusted CA bundle. This is what the client cert is actually validated against. You can get the results of this validation using SSL::verify_result (Click here).

 

 

The other option is the advertised CA cert. This is what LTM sends to the client in order for the client to select a corresponding client cert.

 

 

If you're selectively requesting a client cert based on the URI, the client SSL profile client cert option should be set to ignore. However, when you do this, the GUI removes the option for specifying the advertised CA cert. Unfortunately, there isn't an option to specify this in an iRule when renegotiating the SSL handshake to request a client cert.

 

 

So someone here previously posted a workaround. You basically configure a parent client SSL profile with the cert mode set to request or require. You configure the advertised client cert in that profile. You can then create a child client SSL profile based on the new parent profile. In that profile, you set the cert mode to ignore and select the 'Trusted Certificate Authorities' to the same client cert CA bundle that you specified in the parent profile for 'Advertised Certificate Authorities'. It's a little complicated to explain but simple to configure.

 

 

Here is an example as shown in the bigip.conf:

 

 

-- Parent profile with the Advertised Certificate Authorities configured:

 

 

b profile clientssl clientssl_parent_request_cert list

 

profile clientssl clientssl_parent_request_cert {

 

defaults from clientssl

 

client cert ca "my_client_cert_ca_bundle.crt"

 

peer cert mode request

 

}

 

 

-- Child profile using the parent for details with the Trusted Certificate Authorities configured:

 

-- (note that you don't see the Advertised Certificate Authorities option becuase it's not set in this profile--just the parent profile)

 

 

b profile clientssl clientssl_client_ignore_cert list

 

profile clientssl clientssl_client_ignore_cert {

 

defaults from clientssl_parent_request_cert

 

ca file "my_client_cert_ca_bundle.crt"

 

peer cert mode ignore

 

}

 

 

-- Listing of the full properties configured for the Child profile

 

-- including those it inherits from the parent profile:

 

 

b profile clientssl clientssl_client_ignore_cert list all

 

profile clientssl clientssl_client_ignore_cert {

 

defaults from clientssl_parent_request_cert

 

mode enable

 

key "default.key"

 

cert "default.crt"

 

chain none

 

ca file "my_client_cert_ca_bundle.crt"

 

crl file none

 

client cert ca "my_client_cert_ca_bundle.crt"

 

ciphers "DEFAULT"

 

passphrase none

 

options dont insert empty fragments

 

modssl methods disable

 

cache size 20000

 

cache timeout 3600

 

renegotiate period indefinite

 

renegotiate size indefinite

 

renegotiate max record delay 10

 

handshake timeout 60

 

alert timeout 60

 

peer cert mode ignore

 

authenticate once

 

authenticate depth 9

 

unclean shutdown enable

 

strict resume disable

 

nonssl disable

 

partition Common

 

}

 

 

One other thing: the iRule you reference doesn't add the cert details to the session table. So it would not handle SSL session re-use over multiple TCP connections. Here is an iRule which does do this:

 

 

Insert Cert in Server Headers

 

http://devcentral.f5.com/wiki/default.aspx/iRules/InsertCertInServerHeaders.html

 

 

Aaron

Hello Stephen,

 

 

Like you, I was having the same problem for this obvious problem. Apparently, there is indeed no option in the GUI to configure this, which I find quite strange ...

 

 

However, I just came across this post: http://devcentral.f5.com/Default.aspx?tabid=53&view=topic&postid=4436

 

 

There it is stated to you can simply define this list using the CLI interface, which works ....

 

 

Nice one to end the year ...

 

 

regards

 

 

Koen

 

Hi Koen,

 

 

The major issue with making the change via the CLI (which UnRuley explained) is that you cannot view the client SSL profile in the GUI afterwards or the change will be overwritten. I think the workaround I reposted above is better in that it's not liable to break when someone views the configuration in the GUI.

 

 

Aaron