Forum Discussion

ronsengupta's avatar
ronsengupta
Icon for Nimbostratus rankNimbostratus
Apr 19, 2023

iRule for checking Client TLS cert during TLS Handshake (TLS 1.3)

Hi All, Version- TLS Ver- 1.3 and F5 LTM Is it possible to create an iRule to drop a TCP session if the Client doesn’t provide an acceptable Client Certificate as part of a TLS handshake ?  
devops
security
AlexBCT's avatar
AlexBCT
Icon for Cumulonimbus rankCumulonimbus
Apr 22, 2023

Hi, 

Would the following example be similar to what you are looking for? 

https://f5-agility-labs-irules.readthedocs.io/en/latest/class2/module2/lab3.html

You could of course customize it a bit on what you exactly are looking for, and when to reject it, but this should work under TLS1.3 as well. Here are further certificate commands you could use with this; https://clouddocs.f5.com/api/irules/X509.html

Hope this helps. 

P.S. In the above example, ignore the section under the RULE_INIT event (debug option) - this is unnecessary in the iRule and has the potential of causing all kinds of other problems. 

  • ronsengupta's avatar
    ronsengupta
    Icon for Nimbostratus rankNimbostratus
    Apr 22, 2023

    Thanks for  the response, this needs to be without the F5 doing TLS termination. The 2 way auth need to be directly between the client and server where F5 LTM will act as TCP pass through, however should be able to check that client using a cert without TLS termination.I was thinking about checking the TLS handshake, as TLS handshake happens before the encrypted message exchange, however TLS handshake does not have client cert it only has cipher suites information.