OCSP HTTP Header Specification/Example or field name of EDIPI?

I'm assuming that:

1- The F5 is performing the SSL negotitation with the client's CAC

2- You want to transform the ID in the X509 to a HTTP header and pass it along to the backend server which can read it

 

So you need to capture the X509 information. There is some information about that here:

https://community.f5.com/t5/technical-forum/forwarding-of-x509-http-header-to-application-after-termination/td-p/100895

Then you need to add that header into the transaction using the HTTP::header commmand at either the HTTP_REQUEST or HTTP_REQUEST_RELEASE event. I prefer the latter because it always happens right before we send the request to the backend server.

So a complete irule might look something like this. I used "x-edipi" (custom headers are usually supposed to start with "x-", but that's not a hard rule) for an example, but you'll have to figure out what header the server wants. The F5 doesn't care. A simple test of the header should prevent users from inserting their own header maliciously.

when CLIENTSSL_HANDSHAKE {
  set subj [findstr [X509::subject [SSL::cert 0]] "CN=" 3 ","]
  set EDIPI [string range $subj [expr [string last "." $subj] +1] end]
  log local0. "CAC Auth: Got EDIPI '$EDIPI'"
}

when HTTP_REQUEST_RELEASE {
  if { [HTTP::header exists "x-edipi"] } {
    log local0. "CAC Auth: [IP::client_addr] tried to tell us they were [HTTP::header value x-edipi ]! Drop connection."
    reject
  }
  
  if { [info exists EDIPI] } {
    log local0. "CAC Auth: [IP::client_addr] Inserting $EDIPI"
    HTTP::header replace "x-edipi" $EDIPI
  } else {
    log local0. "EDIPI data not found"
  }
}

As for the client-ssl attached to the virtual, make sure you set the user-auth to "require" (we drop connection if you don't pass the CAC auth) and your allowed-CAs to the proper ones for your CACs.