Peer cert verificaiton error

Are you using this command in a client side, or server side context? This command is currently only available under a client side context, which could be why you're seeing this error.

 

 

Could you please post your full iRule to let us take a look?

 

 

Thanks,

 

-Colin

 

Sure. Here is my iRule:

when CLIENTSSL_HANDSHAKE
    {
    set my_serial_number [X509::serial_number [SSL::cert 0]]
    if { [matchclass $my_serial_number eq $::RMS_blacklist] }
        {
        log local0. [concat "BLACKLISTED serial: " $my_serial_number]
        reject
        }
    else
        {
        log local0. [concat "DEBUG - serial: " $my_serial_number]
        }
    }

And some additional info:

- RMS_blacklist is an external data group containing integers. It's meant to contain certificate serial numbers.

- This iRule is assigned to one of our virtual servers, which is enabled only on External traffic (if that counts).

How do I know which side our script is running on? I automatically assumed that it would be running on client-side, but now I'm uncertain.

Thanks for your help in advance,

Tote

We just got finished banging our heads against the wall with a peer cert verify error that was breaking everything.

 

 

I think our message was slightly different - to do with not finding the Root CA. We originally had the Root CA for a particular cert chain installed on the BIGIP, but then needed to remove it. It took all day to realize things were breaking because on our Server SSL profiles, we had the box selected for Verify Server Certificate...and since it could no longer work it's way up the chain to the Root, the verification was failing and breaking everything.

 

 

Hope this helps in some way.

 

 

-Bill

I think it's a client-side thing. At least I've checked the configuration of the virtual server in question and found an SSL profile selected in SSL Profile (client) listbox. And the server-side listbox contains nothing (or None, indeed).

 

 

I've also checked the SSL profile in question and everything seemed fine to my rookie eyes.

 

 

Actually, I'm looking for the root of the problem by examining the Trusted CAs. I'm not sure, though, if this the right thing to do and unfortunately I haven't yet found any problems. Btw, I found one thing: is it a problem if the certificate of my (trusted) CA doesn't have a serial number? Note that we're talking about a self-issued certificate.

 

 

Thanks,

 

 

Tote