Problem inserting SSL client certificate subject into a header of an HTTP session

Thanks for your reply. We have added logic in the rule to account for not re-executing the HTTP_REQUEST event. However, in this version we are still assuming that issuing the SSL::renegotiate command will retrigger the CLIENTSSL_CLIENTCERT event. According to our testing so far we seen that the CLIENTSSL_CLIENTCERT will not retrigger. If we cannot re-execute the event, do you have any thoughts on how to re-add the subject into the session table within the HTTP_REQUEST event?

 

 

Also, I would still like to know if re-adding the SSL subject into the session table will reset the timeout counter (assumption 2 from original post)?

 

 

when CLIENTSSL_CLIENTCERT {

 

set ssl_cert [SSL::cert 0]

 

set subject [X509::subject $ssl_cert]

 

session add ssl [SSL::sessionid] $subject 1200

 

}

 

 

when HTTP_REQUEST {

 

set ssl_subject [session lookup ssl [SSL::sessionid]]

 

if {$ssl_subject equals ""} {

 

SSL::renegotiate

 

set ssl_subject [session lookup ssl [SSL::sessionid]]

 

}

 

session add ssl [SSL::sessionid] $ssl_subject 1200

 

}

 

 

when HTTP_REQUEST_SEND {

 

clientside {

 

HTTP::header insert SSLClientCertSubject $ssl_subject

 

}

 

}