For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

JOn2's avatar
JOn2
Icon for Nimbostratus rankNimbostratus
Apr 25, 2024

LDAPS and renegotiation

Hello, hope everyone is well!

we have a requirement to present 2 different issuer/signed certificates based on the incoming client IP. I am pretty sure from an HTTP perspective I would do something like this 

when CLIENT_ACCEPTED {
   if {([class match [IP::client_addr] eq signer_list_of_client_A_IPs]) } {  
      SSL::profile cert_with_issuer_type_A
   } else {
      SSL::profile cert_with_issuer_type_B
   }
}

when HTTP_REQUEST {
   SSL::renegotiate 
}

Question I have is whether this would work for LDAPS clients and how (if needed at all) the renegotiation step would be achieved, given that the HTTP_REQUEST will not be available.

Many thanks

Jon

2 Replies

  • Have you tried using renegotiation option from the clientssl profile? 

  • JOn2's avatar
    JOn2
    Icon for Nimbostratus rankNimbostratus

    Thanks Sanjay, good suggestion, I will try that out and report back!