Forum Discussion
James_Michalak_
Nimbostratus
Apr 11, 2007Insert "different" SSL certificate into header
I have an irule (v9.2.4) that will grab the client certificate (Profile set to "Require" cert) presented during negotiation and insert it into the SSLClientCert Header variable (It also removes formatting so only a single continuous string remains...I've pieced this together from other posts...thank you!):
when CLIENTSSL_CLIENTCERT {
set ssl_cert [SSL::cert 0]
session add ssl [SSL::sessionid] $ssl_cert 180
}
when HTTP_REQUEST {
HTTP::header insert SSLClientCert [join [string trim [string map {"-----BEGIN CERTIFICATE-----" "" "-----END CERTIFICATE-----" ""} [X509::whole [session lookup ssl [SSL::sessionid]]]]] ""]
}
This code successfully inserts the certificate when I test using my browser (IE). I recieve a prompt, select the certificate, and am successfully validated. When I veiw the traffic being forwarded from the F5 to the pool member, I can see the SSLClientCert header variable containing the appropriate string.
My problem is that the irule doesn't appear to work when a SOAP call is made to my VIP from an automated system. The SSL negotiation is successful (the request reaches the backend server), but the client certificate isn't inserted into the header.
I've attempted to view the negotiation process to determine the differences but the negotiation is encrypted and I can't view the packet data. Any ideas? Please advise.
Thank you,
James
- hoolio
Cirrostratus
You can try using log statements in the rule to see where the failure is occurring. You could also capture a tcpdump and then use ssldump to decrypt the trace. This assumes that you're using a cipher that ssldump can decrypt. - Lars_Terje_Vaal
Nimbostratus
Hi. Did you find a working solution for this? I'm trying to do the same thing.
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects