HTTP::respond Command in the CLIENTSSL_HANDSHAKE Event

Just a stretch here, but if it is or was allowed, it probably shouldn't be. The CLIENTSSL_HANDSHAKE command should be triggering at the completion of the SSL handshake (layers 5/6) and before the HTTP HUD filter kicks in (layer 7). I would probably assign a local variable and pick that up in the HTTP_REQUEST event.

Hey Kevin,

Understood and that's what I'm doing on an OCSP check but if it's just a case of no client certificate being presented I seem to be out of options. I've tried TCP:: respond without success. I assume SSL::respond will be equally pointless?

You'll necessarily want to do this in your auth rule, so here's a minor modification that should work for you:

when CLIENT_ACCEPTED {
    set tmm_auth_ssl_ocsp_sid 0
    set tmm_auth_ssl_ocsp_done 0
}
when CLIENTSSL_CLIENTCERT {
    if { [SSL::cert count] > 0 } {
        set tmm_auth_ssl_ocsp_done 0
        if {$tmm_auth_ssl_ocsp_sid == 0} {
            set tmm_auth_ssl_ocsp_sid [AUTH::start pam default_ssl_ocsp]
            if {[info exists tmm_auth_subscription]} {
                AUTH::subscribe $tmm_auth_ssl_ocsp_sid
            }
        }
        AUTH::cert_credential $tmm_auth_ssl_ocsp_sid [SSL::cert 0]
        AUTH::cert_issuer_credential $tmm_auth_ssl_ocsp_sid [SSL::cert issuer 0]
        AUTH::authenticate $tmm_auth_ssl_ocsp_sid
        SSL::handshake hold
    } else {
         no cert
        set NOCERT 1
        SSL::session invalidate
    }
}
when CLIENTSSL_HANDSHAKE {
    set tmm_auth_ssl_ocsp_done 1
}
when AUTH_RESULT {
    if {[info exists tmm_auth_ssl_ocsp_sid] and ($tmm_auth_ssl_ocsp_sid == [AUTH::last_event_session_id])} {
        set tmm_auth_status [AUTH::status]
        if {$tmm_auth_status == 0} {
            set tmm_auth_ssl_ocsp_done 1
            SSL::handshake resume
        } elseif {$tmm_auth_status != -1 || $tmm_auth_ssl_ocsp_done == 0} {
            reject
        }
    }
}
when HTTP_REQUEST {
    if { [info exists NOCERT] } {
        HTTP::redirect "http://www.yahoo.com"
    }
}

Can't do links in a comment so just to continue, on the plus side, all this work has enabled me to come up with this HTTPS/SSL event order diagram which I'm sure I and others will find very useful in future. Still a few update due but it's accurate: https://devcentral.f5.com/questions/irule-event-order-https-ssl-client-server-side (as far as I know).