Forum Discussion
s3s1277_111291
Jan 03, 2012Nimbostratus
http redirect when there is no client cert
Is there a way to HTTP redirect, when there is no client certificate, in the request received at the F5? I see we can't use HTTP::redirect within CLIENTSSL_CLIENTCERT method.
hooleylist
Jan 03, 2012Cirrostratus
If you want to send an HTTP response when no client cert is provided, you would need to set the client cert mode to request on the client SSL profile. You could then use an iRule like this:
when HTTP_REQUEST {
Check if there is more than one client cert
if {[SSL::cert count] > 0}{
Check if there was no error in validating the client cert against LTM's server cert
if { [SSL::verify_result] == 0 }{
Exit this event in this iRule
return
} else {
Use the SSL status code in the HTTP response (defined here: http://www.openssl.org/docs/apps/verify.htmlDIAGNOSTICS)
set error_string [X509::verify_cert_error_string [SSL::verify_result]]
}
} else {
set error_string "No client certificate provided"
}
If we are still executing this iRule, the client did not present a cert or did not present a valid cert
HTTP::respond 403 content "Invalid client certificate: $error_string"
}
Aaron
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects