For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

rcurr9999tcf_35's avatar
rcurr9999tcf_35
Icon for Nimbostratus rankNimbostratus
Jul 26, 2018

iRule to validate that the client certificate is allowed via CN

Hi All, I am trying to write an iRule to check the client certificate and if the cert does not contain the two CN entries below client certificate authentication is rejected and logged. Is my synt...
LTM
security
RaghavendraSY's avatar
RaghavendraSY
Icon for Altostratus rankAltostratus
Jul 27, 2018

Please try with below one

when CLIENTSSL_CLIENTCERT { Make sure the client sent a cert if {[SSL::cert 0] eq ""}{ If not, reset the connection reject } else { set subject_dn [X509::subject [SSL::cert 0]]

  log "Client Certificate Received: $subject_dn"
   Make sure the CN is what we're expecting
  if { $subject_dn contains "CN=domainname" } {
      Accept the client cert
     log "Client Certificate Accepted: $subject_dn"
  } else {
     log "No Matching Client Certificate Was Found Using: $subject_dn"
     reject
  }

} }