Forum Discussion
NimbostratusIrule and accepting a Client Cert
Hello , I am trying to configure two way SSL on a V11 F5 LTM/ASM . I'd like to check the common name of the client cert present by the client.
when CLIENTSSL_CLIENTCERT {
log local0. "Client IP - [IP::client_addr]"
log local0. "Cert Error - [X509::verify_cert_error_string [SSL::verify_result]]"
if { not ([class match [X509::subject [SSL::cert 0]] starts_with ssgdev_cn_class]) } {
log local0. "- Client certificate rejected"
log local0. "Cert Subject- [X509::subject [SSL::cert 0]]"
reject
return
}
}
In the log I see the following.
Client IP - xx.xx.xx.xx
Rule /Common/ssgdev_rule : Cert Error - application verification failure
TCL error: /Common/ssgdev_rule - while executing "X509::subject [SSL::cert 0]"
I have not run into this before. What does it mean ?
11 Replies
- Kevin_Stewart
Employee
The "application verification failure" message is usually indicative of a certificate validation issue. I'd recommend to first manually validate the client certificate against the specified CA using the OpenSSL verify command:
openssl verify -CAfile [CA certificate] [user certificate] 
uniAltocumulus
I think your client has not supplied a certificate. Check that [SSL::cert count] > 0 before executing [X509::subject [SSL::cert 0]]
- Kevin_StewartI don't believe the CLIENTSSL_CLIENTCERT event will be triggered if the client isn't presenting a certificate.
- uniGood point. I wonder why there is a TCL error then
- uniThe event is triggered. I have a rule which logs the cert count in that event, and it logs 0 regularly. Jim should look at the example in the Wiki: https://clouddocs.f5.com/api/irules/X509__subject.html It does almost exactly what he wants. He will need to pick out the CN from the subject. e.g change the test to if { [X509::subject [SSL::cert 0]] contains "CN=my.common.name" }
uni_87886Cirrostratus
I think your client has not supplied a certificate. Check that [SSL::cert count] > 0 before executing [X509::subject [SSL::cert 0]]
- Kevin_StewartI don't believe the CLIENTSSL_CLIENTCERT event will be triggered if the client isn't presenting a certificate.
- uni_87886Good point. I wonder why there is a TCL error then
- uni_87886The event is triggered. I have a rule which logs the cert count in that event, and it logs 0 regularly. Jim should look at the example in the Wiki: https://clouddocs.f5.com/api/irules/X509__subject.html It does almost exactly what he wants. He will need to pick out the CN from the subject. e.g change the test to if { [X509::subject [SSL::cert 0]] contains "CN=my.common.name" }
