Forum Discussion

kunjan_118660's avatar
kunjan_118660
Icon for Cumulonimbus rankCumulonimbus
Mar 30, 2015

You can have an 'logging' agent in the fallback path to log session.ssl.cert.valid and modify the 'Edit Endings' in the VPE to present customized error page.

Or can have iRule to have more custom response using ACCESS:respond 

when ACCESS_POLICY_COMPLETED {
    set policy_result [ACCESS::policy result]
    switch $policy_result {
    "allow" {
     Do nothing
    }
    "deny" {
        ACCESS::respond 401 content "Error: Failure in Authentication" Connection Close
    }
    }
}

https://devcentral.f5.com/wiki/iRules.ACCESS__respond.ashx

eric_156978's avatar
eric_156978
Icon for Cirrus rankCirrus
Mar 31, 2015
Hi kunjan, Thanks for the info. I didn't realize "ACCESS:respond" existed, I think that's what i'll end up using. I tried putting your irule in place, but i can't seem to get it to respond properly or confirm that it is being processed. Steps: 1. Open a new browser session incognito so no cookies/ssl persistence exists. 2. Get prompted for a certificate, purposefully hit cancel to not select client certificate. 3. IE: Page cannot be displayed. Chrome: ERR_CONNECTION_RESET I've tried a few different methods to capture the failure, but every time I try a respond iruile, it seems like the SSL connection bombs out and the page won't present content. The first step in my access policy is a "on demand cert auth" and if it fails, it goes to "deny". Would there be something that needs to be adjusted with the access policy to allow those errors to be captured/handled?