Forum Discussion

James_Michalak_'s avatar
James_Michalak_
Icon for Nimbostratus rankNimbostratus
Apr 11, 2007

Insert "different" SSL certificate into header

I have an irule (v9.2.4) that will grab the client certificate (Profile set to "Require" cert) presented during negotiation and insert it into the SSLClientCert Header variable (It also removes formatting so only a single continuous string remains...I've pieced this together from other posts...thank you!):
when CLIENTSSL_CLIENTCERT { 
set ssl_cert [SSL::cert 0] 
session add ssl [SSL::sessionid] $ssl_cert 180
}
when HTTP_REQUEST {  
HTTP::header insert SSLClientCert [join [string trim [string map {"-----BEGIN CERTIFICATE-----" "" "-----END CERTIFICATE-----" ""} [X509::whole [session lookup ssl [SSL::sessionid]]]]] ""]
}
This code successfully inserts the certificate when I test using my browser (IE). I recieve a prompt, select the certificate, and am successfully validated. When I veiw the traffic being forwarded from the F5 to the pool member, I can see the SSLClientCert header variable containing the appropriate string.

 

 

My problem is that the irule doesn't appear to work when a SOAP call is made to my VIP from an automated system. The SSL negotiation is successful (the request reaches the backend server), but the client certificate isn't inserted into the header.

 

 

I've attempted to view the negotiation process to determine the differences but the negotiation is encrypted and I can't view the packet data. Any ideas? Please advise.

 

 

Thank you,

 

James
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    You can try using log statements in the rule to see where the failure is occurring. You could also capture a tcpdump and then use ssldump to decrypt the trace. This assumes that you're using a cipher that ssldump can decrypt.

     

     

    Aaron
  • Hi. Did you find a working solution for this? I'm trying to do the same thing.

     

     

    Regards

     

    Lars Terje