Forum Discussion

Sri1's avatar
Sri1
Icon for Altocumulus rankAltocumulus
Nov 25, 2024

iRule for client certificate verification and inserting CN

Hi dears,

 

I am trying to write an irule for the below conditions

 

Need to verify the client certificate available and valid otherwise 401 response for unauthorized clients, because this does not show 401 or any relevant messages on the browser for failed authentication.

Also need to add the CN from the client certificate as http header to backend server.

 

when CLIENTSSL_CLIENTCERT {
    # Check if the client certificate was provided and valid
    if { [SSL::cert count] == 0 || [SSL::verify_result] != 0 } {
        # Set a flag to trigger the redirect for a failed certificate
        set client_cert_failed 1
    } else {
        # Extract the Common Name (CN) from the client certificate
        set client_cert_cn [X509::subject [SSL::cert 0]]
        # Clear the flag as the certificate is valid
        unset client_cert_failed
    }
}

when HTTP_REQUEST {
    # Check if the client certificate validation failed
    if { [info exists client_cert_failed] && $client_cert_failed == 1 } {
        # Send a 401 Unauthorized response
        HTTP::respond 401 content "Unauthorized: Client Certificate Required" Content-Type "text/plain"
        return
    }

    # Add the CN from the client certificate as a header if it exists
    if { [info exists client_cert_cn] } {
        HTTP::header insert X-Client-Cert-CN $client_cert_cn
    }
}

 

But this does not have any hits when I apply to VS, any suggestion or how you overcome this  requirement will be helpful.

 

  • see SSL client profile.   Client Authentication.

    Client Certificate needs to be request or require 

    Trusted and Adv CA definitions also needed (in my experience).  is certificates bundle of the CA's for all the client certificates.   

  • tls session must be created before http session begins (including client's first http request).

    in order for f5 to be able to send http 401, then you have to ALLOW ALL clients tls session setup requests, regardless of the client tls cert validity.
    and then use when HTTP_REQUEST to be able to read request URL and evaluate client certificate
    (use Request mode instead of Require in vserver's client side ssl profile: https://my.f5.com/manage/s/article/K14819)