Forum Discussion

s3s1277_111291's avatar
Icon for Nimbostratus rankNimbostratus
Jan 03, 2012

http redirect when there is no client cert

Is there a way to HTTP redirect, when there is no client certificate, in the request received at the F5? I see we can't use HTTP::redirect within CLIENTSSL_CLIENTCERT method.

1 Reply

  • If you want to send an HTTP response when no client cert is provided, you would need to set the client cert mode to request on the client SSL profile. You could then use an iRule like this:



    when HTTP_REQUEST {
     Check if there is more than one client cert
    if {[SSL::cert count] > 0}{
     Check if there was no error in validating the client cert against LTM's server cert
    if { [SSL::verify_result] == 0 }{
     Exit this event in this iRule
    } else {
     Use the SSL status code in the HTTP response (defined here:
    set error_string [X509::verify_cert_error_string [SSL::verify_result]]
    } else {
    set error_string "No client certificate provided"
     If we are still executing this iRule, the client did not present a cert or did not present a valid cert
    HTTP::respond 403 content "Invalid client certificate: $error_string"