Forum Discussion
iRule for client certificate verification and inserting CN
Hi dears,
I am trying to write an irule for the below conditions
Need to verify the client certificate available and valid otherwise 401 response for unauthorized clients, because this does not show 401 or any relevant messages on the browser for failed authentication.
Also need to add the CN from the client certificate as http header to backend server.
when CLIENTSSL_CLIENTCERT {
# Check if the client certificate was provided and valid
if { [SSL::cert count] == 0 || [SSL::verify_result] != 0 } {
# Set a flag to trigger the redirect for a failed certificate
set client_cert_failed 1
} else {
# Extract the Common Name (CN) from the client certificate
set client_cert_cn [X509::subject [SSL::cert 0]]
# Clear the flag as the certificate is valid
unset client_cert_failed
}
}
when HTTP_REQUEST {
# Check if the client certificate validation failed
if { [info exists client_cert_failed] && $client_cert_failed == 1 } {
# Send a 401 Unauthorized response
HTTP::respond 401 content "Unauthorized: Client Certificate Required" Content-Type "text/plain"
return
}
# Add the CN from the client certificate as a header if it exists
if { [info exists client_cert_cn] } {
HTTP::header insert X-Client-Cert-CN $client_cert_cn
}
}
But this does not have any hits when I apply to VS, any suggestion or how you overcome this requirement will be helpful.
- Sri1Altocumulus
Any reply on this is a appreciated.
- KerryCirrus
see SSL client profile. Client Authentication.
Client Certificate needs to be request or require
Trusted and Adv CA definitions also needed (in my experience). is certificates bundle of the CA's for all the client certificates.
- zamroni777Nacreous
tls session must be created before http session begins (including client's first http request).
in order for f5 to be able to send http 401, then you have to ALLOW ALL clients tls session setup requests, regardless of the client tls cert validity.
and then use when HTTP_REQUEST to be able to read request URL and evaluate client certificate
(use Request mode instead of Require in vserver's client side ssl profile: https://my.f5.com/manage/s/article/K14819)
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com